T1012 Query Registry
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility,…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Exports Critical Registry Keys To a Filehightest · windows
- HackTool - PCHunter Executionhightest · windows
- Operation Wocao Activityhightest · windows
- Operation Wocao Activity - Securityhightest · windows
- Potential Baby Shark Malware Activityhightest · windows
- SAM Registry Hive Handle Requesthightest · windows
- SysKey Registry Keys Accesshightest · windows
- Azure AD Health Monitoring Agent Registry Keys Accessmediumtest · windows
- Azure AD Health Service Agents Registry Keys Accessmediumtest · windows
- Potential Configuration And Service Reconnaissance Via Reg.EXEmediumtest · windows
- Registry Enumeration via WMI Stdregprovmediumexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.