Windows Process: reg.exe Software Version Discovery via svcVersion Query

title: "Windows Process: reg.exe Software Version Discovery via svcVersion Query"
id: 9d2eb13b-97ce-403b-b97b-d6b7347a9760
related:
  - id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282
    type: derived
  - id: e13f668e-7f95-443d-98d2-1816a7648a7b
    type: derived
status: test
description: This rule matches Windows process creation events where reg.exe is invoked with command-line arguments indicating a query for Software version information, specifically /v svcVersion and a path containing \Software\. Attackers use software discovery to identify installed versions and tailor follow-on actions such as targeting exposed vulnerabilities or security tooling. Telemetry relied on includes the process image ending in \reg.exe and the full command line text containing the expected query components.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
  - https://github.com/harleyQu1nn/AggressorScripts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-16
modified: 2022-10-09
tags:
  - attack.discovery
  - attack.t1518
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \reg.exe
    CommandLine|contains|all:
      - query
      - \software\
      - /v
      - svcversion
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1