Sigma rule: System Information Discovery via Registry Queries

Rule

Title

System Information Discovery via Registry Queries

Status

experimental

Level

low

Author

lazarg

Date

2025-06-12

Modified

2025-10-25

File

rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects attempts to query system information directly from the Windows Registry.

Log source

product

windows

category

process_creation

Detection

selection_cmd_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains: 'query'
    CommandLine|contains|windash: '-v'
selection_cmd_powershell:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains:
        - 'Get-ItemPropertyValue'
        - 'gpv'
selection_keys:
    CommandLine|contains:
        - '\SOFTWARE\Microsoft\Windows Defender' # Details about defender state
        - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion' # Provides details about the OS
        - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' # Lists installed programs
        - '\SYSTEM\CurrentControlSet\Control\TimeZoneInformation' # Contains time zone details
        - '\SYSTEM\CurrentControlSet\Services' # Details about existing services
condition: 1 of selection_cmd_* and selection_keys

False positives (as the rule lists them)

• Unlikely

Tags

• attack.discovery
• attack.t1082

MITRE ATT&CK ids this rule names

• T1082

References

• https://cert.gov.ua/article/6277849
• https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
• https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml