MITRE ATT&CK technique
Query Registry detection rulesT1012
Query Registry (T1012) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 14 community-maintained Sigma detection rules in the library mapped to T1012 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Exports Critical Registry Keys To a File
highDetects the export of a crital Registry key to a file.
windows · process_creation
HackTool - PCHunter Execution
highDetects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
windows · process_creation
Operation Wocao Activity
highDetects activity mentioned in Operation Wocao report
windows · process_creation
Operation Wocao Activity - Security
highDetects activity mentioned in Operation Wocao report
windows
Potential Baby Shark Malware Activity
highDetects activity that could be related to Baby Shark malware
windows · process_creation
SAM Registry Hive Handle Request
highDetects handles requested to SAM registry hive
windows
SysKey Registry Keys Access
highDetects handle requests and access operations to specific registry keys to calculate the SysKey
windows
Azure AD Health Monitoring Agent Registry Keys Access
mediumThis detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.
windows
Azure AD Health Service Agents Registry Keys Access
mediumThis detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation). This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent. Make sure you set the SACL to propagate to its sub-keys.
windows
Potential Configuration And Service Reconnaissance Via Reg.EXE
mediumDetects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
windows · process_creation
Potential Registry Reconnaissance Via PowerShell Script
mediumDetects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.
windows · ps_script
Registry Enumeration via WMI Stdregprov
mediumDetects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.
windows · process_creation
Remote Registry Management Using Reg Utility
mediumRemote registry management using REG utility from non-admin workstation
windows
Exports Registry Key To a File
lowDetects the export of the target Registry key to a file.
windows · process_creation