Sigma rule: Potential Configuration And Service Reconnaissance Via Reg.EXE

Rule

Title

Potential Configuration And Service Reconnaissance Via Reg.EXE

Status

test

Level

medium

Author

Timur Zinniatullin, oscd.community

Date

2019-10-21

Modified

2026-10-19

File

rules/windows/process_creation/proc_creation_win_reg_query_registry.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_flag:
    CommandLine|contains: ' query '
selection_key:
    CommandLine|contains:
        - 'currentVersion\windows'
        - 'winlogon\'
        - 'currentVersion\shellServiceObjectDelayLoad'
        - 'currentVersion\run' # Also covers the strings "RunOnce", "RunOnceEx" and "runServicesOnce"
        - 'currentVersion\policies\explorer\run'
        - 'currentcontrolset\services'
filter_optional_yammer:
    ParentImage|endswith: '\Yammer.exe'
    CommandLine: 'C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Yammer'
condition: all of selection_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Discord

Tags

• attack.discovery
• attack.t1012
• attack.t1007

MITRE ATT&CK ids this rule names

• T1007
• T1012

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_reg_query_registry.yml