{"id":"970007b7-ce32-49d0-a4a4-fbef016950bd","title":"Potential Configuration And Service Reconnaissance Via Reg.EXE","description":"Detects the usage of \"reg.exe\" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2019-10-21","modified":"2023-02-05","tags":["attack.discovery","attack.t1012","attack.t1007"],"technique_ids":["T1007","T1012"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Discord"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_query_registry.yml","source_sha256":"45bd6cd348a81e8042fc678499a0f9fae26b6c21bbc839940bf647d8e2e298e9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Configuration And Service Reconnaissance Via Reg.EXE\nid: 970007b7-ce32-49d0-a4a4-fbef016950bd\nstatus: test\ndescription: Detects the usage of \"reg.exe\" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md\nauthor: Timur Zinniatullin, oscd.community\ndate: 2019-10-21\nmodified: 2023-02-05\ntags:\n    - attack.discovery\n    - attack.t1012\n    - attack.t1007\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_flag:\n        CommandLine|contains: 'query'\n    selection_key:\n        CommandLine|contains:\n            - 'currentVersion\\windows'\n            - 'winlogon\\'\n            - 'currentVersion\\shellServiceObjectDelayLoad'\n            - 'currentVersion\\run' # Also covers the strings \"RunOnce\", \"RunOnceEx\" and \"runServicesOnce\"\n            - 'currentVersion\\policies\\explorer\\run'\n            - 'currentcontrolset\\services'\n    condition: all of selection_*\nfalsepositives:\n    - Discord\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","page":"techniques/enterprise/T1007/"},{"key":"enterprise/T1012","id":"T1012","name":"Query Registry","page":"techniques/enterprise/T1012/"}],"data_path":"data/detection-rules/970007b7-ce32-49d0-a4a4-fbef016950bd.json","kind":"sigma"}