T1012 Query Registry — Attack Simulation

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Query Registry with Powershell cmdlets
windows automated powershell
Procedure 0434d081-bb32-42ce-bcbb-3548e4f2628f; elevation required; cleanup not declared. Not executed or individually validated.
Enumerate COM Objects in Registry with Powershell
windows automated powershell
Procedure 0d80d088-a84c-4353-af1a-fc8b439f1564; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Check Software Inventory Logging (SIL) status via Registry
windows automated command_prompt
Procedure 5c784969-1d43-4ac7-8c3d-ed6d025ed10d; elevation required; cleanup not declared. Not executed or individually validated.
Reg query for AlwaysInstallElevated status
windows automated command_prompt
Procedure 6fb4c4c5-f949-4fd2-8af5-ddbc61595223; elevation required; cleanup not declared. Not executed or individually validated.
Query Registry
windows automated command_prompt
Procedure 8f7578c4-9863-4d83-875c-a565573bbdf0; elevation required; cleanup not declared. Not executed or individually validated.
Inspect SystemStartOptions Value in Registry
windows automated command_prompt
Procedure 96257079-cdc1-4aba-8705-3146e94b6dce; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows discovery isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate technique source_mapped

Detection and collection

T1012 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.