Windows reg.exe Registry Query Reconnaissance (Process Creation)
Alerts on reg.exe process executions performing registry queries against high-value configuration and service keys.
- Product
- windows
- Category
- process_creation
- Author
- Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-21
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions of reg.exe where the command line includes registry query activity and targets commonly recon-related keys such as currentVersion, winlogon, shellServiceObjectDelayLoad, run locations, explorer run policies, and currentcontrolset\services. Attackers use registry queries to collect system configuration, installed software signals, and credential or persistence-adjacent information before further actions. It relies on Windows process creation telemetry capturing Image/OriginalFileName and the full command line content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows reg.exe Registry Query Reconnaissance (Process Creation)
id: ebfe5434-4b12-47d5-99df-f2397ba9d290
status: test
description: This rule flags executions of reg.exe where the command line includes registry query activity and targets commonly recon-related keys such as currentVersion, winlogon, shellServiceObjectDelayLoad, run locations, explorer run policies, and currentcontrolset\services. Attackers use registry queries to collect system configuration, installed software signals, and credential or persistence-adjacent information before further actions. It relies on Windows process creation telemetry capturing Image/OriginalFileName and the full command line content.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-02-05
tags:
- attack.discovery
- attack.t1012
- attack.t1007
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_flag:
CommandLine|contains: query
selection_key:
CommandLine|contains:
- currentVersion\windows
- winlogon\
- currentVersion\shellServiceObjectDelayLoad
- currentVersion\run
- currentVersion\policies\explorer\run
- currentcontrolset\services
condition: all of selection_*
falsepositives:
- Discord
level: medium
license: DRL-1.1
related:
- id: 970007b7-ce32-49d0-a4a4-fbef016950bd
type: derived