T1012 Query Registry — Detection Rules

Detection workspace for T1012 Query Registry: 9 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.

Source-backed rule directory

Azure AD Health Monitoring Agent Registry Keys Access · test · medium · {"product":"windows","service":"security"}
Azure AD Health Service Agents Registry Keys Access · test · medium · {"product":"windows","service":"security"}
SAM Registry Hive Handle Request · test · high · {"product":"windows","service":"security"}
SysKey Registry Keys Access · test · high · {"product":"windows","service":"security"}
HackTool - PCHunter Execution · test · high · {"category":"process_creation","product":"windows"}
Potential Configuration And Service Reconnaissance Via Reg.EXE · test · medium · {"category":"process_creation","product":"windows"}
Exports Critical Registry Keys To a File · test · high · {"category":"process_creation","product":"windows"}
Exports Registry Key To a File · test · low · {"category":"process_creation","product":"windows"}
Registry Enumeration via WMI Stdregprov · experimental · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0209 Detection of Registry Query for Environmental Discovery

AN0589 Analytic 0589

Registry read access associated with suspicious or non-interactive processes querying system config, installed software, or security settings.

Connected ecosystem references

Linked tags

rule_source_available

Simulation, tools and telemetry

T1012 simulation workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.