Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.

FreeReviewedSigma · Low · v2

Product: windows
Category: process_creation
Author: lazarg (SigmaHQ), DRL 1.1
Published: 2025-06-12
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions that query Windows Registry system information using reg.exe or PowerShell. Attackers may use these queries to enumerate OS details, Defender state, installed software, time zone information, and existing services. It relies on process creation telemetry capturing the executable image, command line content, and Registry path strings.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

Suspicious Security Policy Export via SecEdit (via process_creation)

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Pivot detection · T1082 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-discovery-via-registry-queries-reg-exe-and-powershell-0022869c

title: Windows Process Information Discovery via Registry Queries (reg.exe/powershell)
id: 965f1e04-3b43-44cb-b7bf-4d2ddffa5c37
status: experimental
description: This rule flags process executions that query Windows Registry system information using reg.exe or PowerShell. Attackers may use these queries to enumerate OS details, Defender state, installed software, time zone information, and existing services. It relies on process creation telemetry capturing the executable image, command line content, and Registry path strings.
references:
  - https://cert.gov.ua/article/6277849
  - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
  - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml
author: lazarg, Huntrule Team
date: 2025-06-12
modified: 2025-10-25
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_reg:
    Image|endswith: \reg.exe
    CommandLine|contains: query
    CommandLine|contains|windash: -v
  selection_cmd_powershell:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - Get-ItemPropertyValue
      - gpv
  selection_keys:
    CommandLine|contains:
      - \SOFTWARE\Microsoft\Windows Defender
      - \SOFTWARE\Microsoft\Windows NT\CurrentVersion
      - \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
      - \SYSTEM\CurrentControlSet\Control\TimeZoneInformation
      - \SYSTEM\CurrentControlSet\Services
  condition: 1 of selection_cmd_* and selection_keys
falsepositives:
  - Unlikely
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml
simulation:
  - type: atomic-red-team
    name: System Information Discovery
    technique: T1010
    atomic_guid: 66703791-c902-4560-8770-42b8a91f7667
  - type: atomic-red-team
    name: Discover OS Product Name via Registry
    technique: T1082
    atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7
  - type: atomic-red-team
    name: Discover OS Build Number via Registry
    technique: T1082
    atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec
license: DRL-1.1
related:
  - id: 0022869c-49f7-4ff2-ba03-85ac42ddac58
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL