T1012 Query Registry

Technique

T1012

Tactics

Discovery

Research, 90 days

4

KEV CVEs mapped

0

SigmaHQ rules

13

Elastic, Splunk

16

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1012

MITRE description

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-02 Group-IB: Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
• 2026-08-31 Group-IB: Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Detection coverage

SigmaHQ community rules

• Potential Baby Shark Malware Activity (emerging-threats)
• Operation Wocao Activity (emerging-threats)
• Operation Wocao Activity - Security (emerging-threats)
• Potential Registry Reconnaissance Via PowerShell Script (threat-hunting)
• Azure AD Health Monitoring Agent Registry Keys Access (core)
• Azure AD Health Service Agents Registry Keys Access (core)
• SAM Registry Hive Handle Request (core)
• SysKey Registry Keys Access (core)
• HackTool - PCHunter Execution (core)
• Potential Configuration And Service Reconnaissance Via Reg.EXE (core)
• Exports Critical Registry Keys To a File (core)
• Exports Registry Key To a File (core)
• Registry Enumeration via WMI Stdregprov (core)

Elastic and Splunk rules

• Enumeration Command Spawned via WMIPrvSE (elastic)
• Query Registry using Built-in Tools (elastic)
• Deprecated - PowerShell Script with Discovery Capabilities (elastic)
• Windows Credential Access From Browser Password Store (splunk)
• Windows Credentials from Password Stores Chrome Extension Access (splunk)
• Windows Credentials from Password Stores Chrome LocalState Access (splunk)
• Windows Credentials from Password Stores Chrome Login Data Access (splunk)
• Windows Hosts File Access (splunk)
• Windows Non Discord App Access Discord LevelDB (splunk)
• Windows Post Exploitation Risk Behavior (splunk)
• Windows Product Key Registry Query (splunk)
• Windows Query Registry Browser List Application (splunk)
• Windows Query Registry UnInstall Program List (splunk)
• Windows Registry Entries Exported Via Reg (splunk)
• Windows Registry Entries Restored Via Reg (splunk)
• Windows Software Discovery Via PowerShell (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.