{"id":"0022869c-49f7-4ff2-ba03-85ac42ddac58","title":"System Information Discovery via Registry Queries","description":"Detects attempts to query system information directly from the Windows Registry.","author":"lazarg","status":"experimental","level":"low","date":"2025-06-12","modified":"2025-10-25","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://cert.gov.ua/article/6277849","https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md","https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md"],"source_path":"rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml","source_sha256":"b454666572a9afba3b5f746f5a52c6792f98ccc0733196b6ea7889cb27caefcf","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Information Discovery via Registry Queries\nid: 0022869c-49f7-4ff2-ba03-85ac42ddac58\nstatus: experimental\ndescription: Detects attempts to query system information directly from the Windows Registry.\nreferences:\n    - https://cert.gov.ua/article/6277849\n    - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md\n    - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md\nauthor: lazarg\ndate: 2025-06-12\nmodified: 2025-10-25\ntags:\n    - attack.discovery\n    - attack.t1082\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmd_reg:\n        Image|endswith: '\\reg.exe'\n        CommandLine|contains: 'query'\n        CommandLine|contains|windash: '-v'\n    selection_cmd_powershell:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        CommandLine|contains:\n            - 'Get-ItemPropertyValue'\n            - 'gpv'\n    selection_keys:\n        CommandLine|contains:\n            - '\\SOFTWARE\\Microsoft\\Windows Defender' # Details about defender state\n            - '\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' # Provides details about the OS\n            - '\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall' # Lists installed programs\n            - '\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation' # Contains time zone details\n            - '\\SYSTEM\\CurrentControlSet\\Services' # Details about existing services\n    condition: 1 of selection_cmd_* and selection_keys\nfalsepositives:\n    - Unlikely\nlevel: low\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: System Information Discovery\n      technique: T1010\n      atomic_guid: 66703791-c902-4560-8770-42b8a91f7667\n    - type: atomic-red-team\n      name: Discover OS Product Name via Registry\n      technique: T1082\n      atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7\n    - type: atomic-red-team\n      name: Discover OS Build Number via Registry\n      technique: T1082\n      atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/0022869c-49f7-4ff2-ba03-85ac42ddac58.json","kind":"sigma"}