Windows reg.exe Registry Query Reconnaissance (Process Creation)

title: Windows reg.exe Registry Query Reconnaissance (Process Creation)
id: ebfe5434-4b12-47d5-99df-f2397ba9d290
status: test
description: This rule flags executions of reg.exe where the command line includes registry query activity and targets commonly recon-related keys such as currentVersion, winlogon, shellServiceObjectDelayLoad, run locations, explorer run policies, and currentcontrolset\services. Attackers use registry queries to collect system configuration, installed software signals, and credential or persistence-adjacent information before further actions. It relies on Windows process creation telemetry capturing Image/OriginalFileName and the full command line content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-02-05
tags:
  - attack.discovery
  - attack.t1012
  - attack.t1007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_flag:
    CommandLine|contains: query
  selection_key:
    CommandLine|contains:
      - currentVersion\windows
      - winlogon\
      - currentVersion\shellServiceObjectDelayLoad
      - currentVersion\run
      - currentVersion\policies\explorer\run
      - currentcontrolset\services
  condition: all of selection_*
falsepositives:
  - Discord
level: medium
license: DRL-1.1
related:
  - id: 970007b7-ce32-49d0-a4a4-fbef016950bd
    type: derived