Windows Process: reg.exe Software Version Discovery via svcVersion Query
Alerts when reg.exe is used to query \Software\ for svcVersion, indicating Windows software version discovery.
- Product
- windows
- Category
- process_creation
- Author
- Nikita Nazarov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-16
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows process creation events where reg.exe is invoked with command-line arguments indicating a query for Software version information, specifically /v svcVersion and a path containing \Software\. Attackers use software discovery to identify installed versions and tailor follow-on actions such as targeting exposed vulnerabilities or security tooling. Telemetry relied on includes the process image ending in \reg.exe and the full command line text containing the expected query components.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
- github.comhttps://github.com/harleyQu1nn/AggressorScripts
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process: reg.exe Software Version Discovery via svcVersion Query"
id: 9d2eb13b-97ce-403b-b97b-d6b7347a9760
related:
- id: 2650dd1a-eb2a-412d-ac36-83f06c4f2282
type: derived
- id: e13f668e-7f95-443d-98d2-1816a7648a7b
type: derived
status: test
description: This rule matches Windows process creation events where reg.exe is invoked with command-line arguments indicating a query for Software version information, specifically /v svcVersion and a path containing \Software\. Attackers use software discovery to identify installed versions and tailor follow-on actions such as targeting exposed vulnerabilities or security tooling. Telemetry relied on includes the process image ending in \reg.exe and the full command line text containing the expected query components.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
- https://github.com/harleyQu1nn/AggressorScripts
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-16
modified: 2022-10-09
tags:
- attack.discovery
- attack.t1518
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \reg.exe
CommandLine|contains|all:
- query
- \software\
- /v
- svcversion
condition: selection
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1