T1012

Query Registry

Discovery Last updated:

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Threat actors including Turla (Epic), APT41 (DUSTTRAP), NOBELIUM (Sibot), Sandworm (TEARDROP), Lazarus (HOPLIGHT), Lyceum (Shark), and numerous commodity malware families leverage registry queries to fingerprint targets, locate credentials, identify installed security products, and discover network proxy configurations.

What is T1012 Query Registry?

Query Registry (T1012) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Query Registry, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1012 Query Registry
Canonical reference
https://attack.mitre.org/techniques/T1012/
Microsoft Sentinel / Defender
kusto 
let SensitiveRegistryPaths = dynamic([
    "Windows NT\\CurrentVersion",
    "HARDWARE\\DESCRIPTION\\System",
    "CurrentVersion\\Uninstall",
    "Microsoft\\Cryptography",
    "CurrentControlSet\\Services",
    "CurrentControlSet\\Control\\Lsa",
    "SimonTatham\\PuTTY\\Sessions",
    "OpenSSH\\Agent\\Keys",
    "Windows\\CurrentVersion\\Internet Settings",
    "Control\\Terminal Server",
    "Software\\Policies",
    "Bitcoin",
    "Image File Execution Options",
    "SOFTWARE\\Microsoft\\CTF",
    "Classes\\http\\shell\\open\\command",
    "CurrentVersion\\Run",
    "CurrentVersion\\RunOnce",
    "WinSCP\\Sessions"
]);
let SuspiciousInitiators = dynamic([
    "wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe",
    "rundll32.exe", "regsvr32.exe", "msbuild.exe", "installutil.exe",
    "excel.exe", "winword.exe", "outlook.exe", "powerpnt.exe"
]);
// Branch 1: reg.exe query / export / save
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "reg.exe"
| where ProcessCommandLine has_any ("query", "export", "save")
| extend TargetKey = extract(@"(?i)(HKLM|HKCU|HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER|HKEY_USERS|HKU|HKCR|HKEY_CLASSES_ROOT)\\[^\s]+", 0, ProcessCommandLine)
| extend SensitivePath = ProcessCommandLine has_any (SensitiveRegistryPaths)
| extend RecursiveQuery = ProcessCommandLine has "/s" or ProcessCommandLine has "-s"
| extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousInitiators)
| extend QueryType = "reg.exe"
| union (
    // Branch 2: PowerShell registry enumeration
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("HKLM:", "HKCU:", "HKEY_LOCAL_MACHINE", "HKEY_CURRENT_USER", "Registry::")
    | where ProcessCommandLine has_any ("Get-Item", "Get-ItemProperty", "Get-ChildItem", "Get-ItemPropertyValue")
    | extend TargetKey = extract(@"(?i)(HKLM:|HKCU:|HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER|Registry::HKEY)[\\\w\s]+", 0, ProcessCommandLine)
    | extend SensitivePath = ProcessCommandLine has_any (SensitiveRegistryPaths)
    | extend RecursiveQuery = ProcessCommandLine has "-Recurse"
    | extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousInitiators)
    | extend QueryType = "PowerShell"
)
| where SensitivePath == true or SuspiciousParent == true or RecursiveQuery == true
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         TargetKey, SensitivePath, RecursiveQuery, SuspiciousParent, QueryType
| sort by Timestamp desc

Detects suspicious Windows Registry queries using reg.exe or PowerShell targeting sensitive registry paths associated with system fingerprinting, credential discovery, and documented malware tradecraft. Two primary execution vectors are monitored: direct reg.exe query/export/save commands and PowerShell Get-Item/Get-ItemProperty/Get-ChildItem cmdlets. Results are filtered to sensitive registry paths (OS version, hardware info, installed software, LSA settings, stored sessions, proxy configuration, RDP settings, persistence keys) and suspicious parent processes (scripting engines, Office apps, LOLBins) to reduce noise while maintaining high-fidelity detection.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • IT administrators using reg.exe or PowerShell scripts for legitimate system auditing, compliance checks, or configuration validation workflows
  • Software deployment tools (SCCM, Intune, Chef, Puppet) that query registry for version checks and configuration state before deploying updates
  • System monitoring and inventory agents (SCOM, Tanium, Qualys, Tenable Nessus) that regularly enumerate installed software via the Uninstall key
  • Help desk and remote support tools (TeamViewer, ConnectWise) querying registry for diagnostic purposes during active support sessions
  • Application installers that read registry paths to detect prerequisites, conflicting software versions, or existing installation state before proceeding

Sigma rule & cross-platform mapping

The detection logic for Query Registry (T1012) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1012 Sigma rules on detection.fyi

Platform-specific guides for T1012

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Registry Query for OS Version and Hardware Information

    Expected signal: Sysmon Event ID 1: Multiple Process Create events with Image=reg.exe, CommandLine containing 'query' and 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' and 'HKLM\HARDWARE\DESCRIPTION\System'. Security Event ID 4688 with identical command line details if command line auditing is enabled. Prefetch entry updated at C:\Windows\Prefetch\REG.EXE-*.pf with current timestamp.

  2. Test 2Recursive Registry Query for Installed Software

    Expected signal: Sysmon Event ID 1: Two Process Create events for reg.exe — one per command — with CommandLine containing 'query', 'Uninstall', and '/s' flag. The recursive query generates a large stdout output but only one process creation event per reg.exe invocation. Security Event ID 4688 with command line if auditing enabled.

  3. Test 3PowerShell Registry Query for Proxy Configuration

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ItemProperty', 'HKCU:', and 'Internet Settings'. PowerShell ScriptBlock Log Event ID 4104 from Microsoft-Windows-PowerShell/Operational with the full command content. Note: read-only registry access does not generate Sysmon Event IDs 12/13/14 — process-level telemetry is the primary detection source.

  4. Test 4Registry Query for Machine GUID and LSA Configuration

    Expected signal: Sysmon Event ID 1: Three sequential Process Create events for reg.exe with CommandLine targeting 'Cryptography', 'Control\Lsa' keys respectively. Security Event ID 4688 with command line if auditing enabled. Consecutive execution timestamps within milliseconds of each other, consistent with scripted automated enumeration rather than manual administrative queries.

Response Playbook

Triage

  1. Identify the process context: was reg.exe or PowerShell invoked from a normal user session, a scheduled task, a service, or spawned by a scripting host (wscript.exe, mshta.exe) or Office application? Non-administrative parents dramatically increase suspicion and should be escalated immediately.
  2. Examine the specific target registry path: sensitive paths (LSA secrets, PuTTY/WinSCP sessions, Cryptography MachineGuid, Internet Settings, CurrentVersion\Uninstall) suggest automated fingerprinting or credential precursor discovery. Note the exact keys queried — this reveals adversary intent.
  3. Determine user context: was this run by a service account, domain admin, or standard user? Would this user or the initiating process legitimately need to access the queried registry path? A standard user querying LSA keys is highly anomalous.
  4. Check for bulk or recursive queries: presence of /s flag (reg.exe) or -Recurse (PowerShell) targeting broad registry hives (HKLM, HKCU) suggests automated framework-driven discovery rather than a specific administrative lookup.
  5. Look for temporal clustering: multiple registry queries within seconds from the same process or session is consistent with automated post-exploitation discovery modules (Cobalt Strike, Metasploit, Empire). Review the process start time relative to query timestamps.
  6. Correlate with preceding events: was there a recent user logon, document open, browser download, or script execution before the registry queries began? Establish the full process tree to identify whether this is part of an infection chain.

Containment

  1. If malware is confirmed: isolate the endpoint immediately via EDR network isolation or VLAN quarantine to prevent C2 or lateral movement using data gathered from registry enumeration.
  2. If registry queries targeted credential-containing paths (LSA, PuTTY Sessions, WinSCP Sessions, OpenSSH Agent Keys): treat all associated credentials as compromised and initiate immediate rotation for all accounts whose credentials may be stored at those paths.
  3. If the querying process is a dropped or injected binary rather than a native Windows tool: terminate the process, quarantine the binary, and block its hash at the EDR policy level across the environment.
  4. If proxy or network configuration was queried (Internet Settings): monitor all outbound connections for C2 traffic leveraging discovered proxy infrastructure and pre-emptively block known-suspicious external destinations.
  5. If the query originated from a PowerShell or script-based process: retrieve full script content from PowerShell ScriptBlock logs (Event ID 4104) to understand the complete discovery scope and identify all subsequent actions beyond registry enumeration.

Evidence Collection

  1. Process Creation Events: Sysmon Event ID 1 or Security Event ID 4688 (with enhanced command line auditing enabled via Group Policy) for the reg.exe or PowerShell process — captures full command line including the specific registry key path targeted.
  2. PowerShell ScriptBlock Logging: Event ID 4104 from Microsoft-Windows-PowerShell/Operational — captures the complete PowerShell command including registry paths even when the invocation is obfuscated at the command line level.
  3. Parent Process Chain: Trace the full process tree above the querying process using Sysmon Event ID 1 correlated by ParentProcessId to identify the originating application, script, or user action.
  4. Registry Access Events: Sysmon Event IDs 12 and 13 cover registry object creation and value modification, but note that read-only registry queries do NOT generate Sysmon registry events — process-level telemetry is the primary source for query detection.
  5. Network Connections: Sysmon Event ID 3 for any outbound connections from the same process or subsequent child processes following registry queries — C2 beaconing and exfiltration commonly follow the discovery phase.
  6. File System Artifacts: Sysmon Event ID 11 for any files written to disk after registry queries — exported .reg or .hive files written to user-writable directories indicate data staging for exfiltration.
  7. Prefetch Files: C:\Windows\Prefetch\REG.EXE-*.pf records execution timestamps and accessed file paths for reg.exe, useful for establishing a historical timeline of registry discovery activity.
  8. Security Event Log: Event ID 4663 (Object Access) if Windows SACL auditing is configured on specific sensitive registry keys — provides key-level access telemetry that process monitoring alone cannot supply.

Escalation Criteria

  • ! Registry queries targeting credential storage paths: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Secrets, HKCU\Software\SimonTatham\PuTTY\Sessions, HKCU\Software\WinSCP, or HKCU\Software\OpenSSH\Agent\Keys — these are high-confidence credential harvesting precursors.
  • ! Bulk recursive enumeration (reg query /s HKLM or Get-ChildItem -Recurse HKLM:) executing from a non-administrative service account or immediately following a suspicious process execution event.
  • ! Registry queries executed by a process with no legitimate business context spawned directly from a scripting host (wscript.exe, cscript.exe, mshta.exe) or an Office application (excel.exe, winword.exe, outlook.exe).
  • ! Registry queries immediately followed within seconds or minutes by outbound network connections to external public IPs from the same process — indicates that discovered data (proxy config, MachineGuid, network info) is being exfiltrated to C2.
  • ! Five or more distinct sensitive registry paths queried in rapid succession from the same process — consistent with automated post-exploitation discovery frameworks running structured enumeration playbooks.
  • ! Registry export operations (reg export or reg save) writing .reg or .hive files to user-writable directories such as %TEMP%, %APPDATA%, or C:\ProgramData — potential staging of registry hives for offline credential extraction.

Investigation Guide

Forensic Artifacts

  • > Prefetch: C:\Windows\Prefetch\REG.EXE-*.pf — execution timestamps for reg.exe invocations with list of referenced file paths, useful for establishing a timeline of registry discovery activity even without live logs.
  • > PowerShell History: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — interactive PowerShell registry queries will be recorded here in plaintext.
  • > Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — records commands typed in the Run dialog, may capture manually entered reg.exe commands.
  • > Security Event Log: Event ID 4688 with ProcessCommandLine auditing enabled — captures reg.exe and PowerShell command line arguments including the specific registry key targets.
  • > Sysmon Event Log: Event ID 1 with CommandLine — primary telemetry source for command line capture of all registry queries via process-level monitoring.
  • > PowerShell Operational Log: Event ID 4104 (ScriptBlock logging) from Microsoft-Windows-PowerShell/Operational — captures PowerShell registry enumeration commands including obfuscated invocations reconstructed by the PowerShell engine.
  • > File System: Any .reg, .hiv, or .dat files written to %TEMP%, %APPDATA%, or C:\ProgramData — may represent exported registry hives staged for offline processing or exfiltration.
  • > ShimCache / AppCompatCache: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — records reg.exe execution history even without ScriptBlock logging, providing evidence of tool usage.

Tuning Guidance

Start by baselining normal registry query behavior in your environment before enabling alerting. The highest-volume false positive sources are: SCCM/ConfigMgr hardware and software inventory scanning (queries Uninstall key extensively from ccmexec.exe), vulnerability scanners (Qualys, Tenable), endpoint management agents (Tanium, BigFix, SCOM), and software installers. Build suppression rules by whitelisting specific verified parent process paths and file hashes rather than broad process names — never suppress on process name alone as that is trivially spoofed. The SensitivePath filter is the primary tuning lever; remove paths that generate excessive false positives in your specific environment and add organization-specific sensitive paths such as custom application configuration keys containing connection strings or API tokens. The SuspiciousParent filter (scripting hosts, Office applications) is very high-fidelity and should be retained even in noisy environments as it rarely generates legitimate false positives. For maximum coverage, note that malware using direct Win32 API calls (RegOpenKeyEx, RegQueryValueEx) without spawning reg.exe or PowerShell will NOT be caught by process-level detections — supplement with Windows Object Access auditing (Event ID 4663) using SACLs on the most sensitive individual registry keys such as HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Secrets and HKCU\Software\SimonTatham\PuTTY\Sessions. Consider also deploying Sysmon registry monitoring (Event IDs 12, 13, 14) targeted at those same specific high-value keys for direct API-level telemetry that bypasses process-based detection.

Hunting Queries

Hunt for hosts or accounts with unusually high volumes of reg.exe query activity over the past week. More than 10 distinct invocations from a single parent process or account is atypical for normal administrative use and may indicate an automated post-exploitation framework running structured registry discovery modules such as Cobalt Strike's execute-assembly or Metasploit's post/windows/gather modules.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "reg.exe"
| where ProcessCommandLine has_any ("query", "export", "save")
| summarize QueryCount=count(), UniqueKeys=dcount(ProcessCommandLine), Earliest=min(Timestamp), Latest=max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName
| where QueryCount > 10
| sort by QueryCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\reg.exe" (CommandLine="* query *" OR CommandLine="* export *" OR CommandLine="* save *")
| stats count as QueryCount, dc(CommandLine) as UniqueKeys, earliest(_time) as Earliest, latest(_time) as Latest by host, User, ParentImage
| where QueryCount > 10
| sort - QueryCount

Hunt for reg.exe registry queries spawned directly from scripting hosts or Office applications. This parent-child relationship is a strong indicator of initial access via a malicious document or script dropper where the adversary's first post-execution action is registry enumeration for target fingerprinting and environment profiling.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "reg.exe"
| where ProcessCommandLine has_any ("query", "export")
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe", "excel.exe", "winword.exe", "outlook.exe", "powerpnt.exe", "msiexec.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\reg.exe" (CommandLine="* query *" OR CommandLine="* export *")
  (ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\winword.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\msiexec.exe")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Hunt specifically for PowerShell registry queries targeting high-value paths used by credential-harvesting malware and documented APT tradecraft: LSA secrets (HOPLIGHT/Lazarus), PuTTY/WinSCP stored sessions (credential theft), OpenSSH key stores, machine GUIDs (Shark/Lyceum victim fingerprinting), Image File Execution Options (defense evasion precursor), and Bitcoin wallet paths (Clambling/DRBControl). These specific path combinations carry very low false positive rates.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Get-ItemProperty", "Get-Item", "Get-ChildItem", "Get-ItemPropertyValue")
| where ProcessCommandLine has_any ("HKLM:", "HKCU:", "HKEY_LOCAL_MACHINE", "HKEY_CURRENT_USER", "Registry::")
| where ProcessCommandLine has_any ("Lsa", "Secrets", "PuTTY", "WinSCP", "OpenSSH", "MachineGuid", "Image File Execution", "Bitcoin", "SimonTatham")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*HKLM:*" OR CommandLine="*HKCU:*" OR CommandLine="*HKEY_LOCAL_MACHINE*" OR CommandLine="*HKEY_CURRENT_USER*" OR CommandLine="*Registry::*")
  (CommandLine="*Get-ItemProperty*" OR CommandLine="*Get-Item*" OR CommandLine="*Get-ChildItem*")
  (CommandLine="*Lsa*" OR CommandLine="*Secrets*" OR CommandLine="*PuTTY*" OR CommandLine="*WinSCP*" OR CommandLine="*OpenSSH*" OR CommandLine="*MachineGuid*" OR CommandLine="*Image File Execution*" OR CommandLine="*Bitcoin*")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Registry Query for OS Version and Hardware Information
windows

Executes registry queries targeting Windows CurrentVersion and hardware description keys to enumerate OS build, product name, and CPU information. This is among the most common initial registry discovery actions performed by malware during the fingerprinting phase, documented in SVCReady (querying HKLM\HARDWARE\DESCRIPTION\System), Hydraq (CPU speed via registry), and numerous ransomware families that profile targets before proceeding with encryption.

Command

powershell 
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName & reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber & reg query "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v ProcessorNameString

Expected Telemetry

Sysmon Event ID 1: Multiple Process Create events with Image=reg.exe, CommandLine containing 'query' and 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' and 'HKLM\HARDWARE\DESCRIPTION\System'. Security Event ID 4688 with identical command line details if command line auditing is enabled. Prefetch entry updated at C:\Windows\Prefetch\REG.EXE-*.pf with current timestamp.

Expected Detection

Alert fires on reg.exe query targeting 'Windows NT\CurrentVersion' and 'HARDWARE\DESCRIPTION\System' (both match SensitiveRegistryPaths). KQL: SensitivePath=true, QueryType='reg.exe'. SPL: SensitivePath=1, IsRegExe=1.

Test 2 Recursive Registry Query for Installed Software
windows

Performs a recursive registry query of the software Uninstall key to enumerate all installed applications. Malware families including Azorult, BlackByte Ransomware, and many RATs use this to identify installed security products (AV, EDR, SIEM agents) and determine whether the environment is monitored or sandboxed. The /s flag performs a recursive sub-key search, a pattern characteristic of automated enumeration rather than manual administrative lookup.

Command

powershell 
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "DisplayName" & reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "DisplayName"

Expected Telemetry

Sysmon Event ID 1: Two Process Create events for reg.exe — one per command — with CommandLine containing 'query', 'Uninstall', and '/s' flag. The recursive query generates a large stdout output but only one process creation event per reg.exe invocation. Security Event ID 4688 with command line if auditing enabled.

Expected Detection

Alert fires on reg.exe recursive query targeting 'CurrentVersion\Uninstall'. KQL: SensitivePath=true, RecursiveQuery=true, QueryType='reg.exe'. SPL: SensitivePath=1, RecursiveQuery=1, IsRegExe=1. The combination of RecursiveQuery and SensitivePath flags increases triage priority.

Test 3 PowerShell Registry Query for Proxy Configuration
windows

Uses PowerShell Get-ItemProperty to enumerate proxy settings from the Windows registry — a technique documented for Sibot (NOBELIUM) querying proxy settings and ZIRCONIUM using tooling to discover proxy configurations. Adversaries use this to understand how to route C2 traffic through organizational proxy infrastructure to blend with legitimate outbound connections and bypass network-based detection.

Command

powershell 
powershell.exe -NoProfile -Command "Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | Select-Object ProxyEnable, ProxyServer, ProxyOverride, AutoConfigURL"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ItemProperty', 'HKCU:', and 'Internet Settings'. PowerShell ScriptBlock Log Event ID 4104 from Microsoft-Windows-PowerShell/Operational with the full command content. Note: read-only registry access does not generate Sysmon Event IDs 12/13/14 — process-level telemetry is the primary detection source.

Expected Detection

Alert fires on PowerShell Get-ItemProperty targeting 'Internet Settings' path. KQL: SensitivePath=true, QueryType='PowerShell'. SPL: SensitivePath=1, IsPowerShellReg=1.

Test 4 Registry Query for Machine GUID and LSA Configuration
windows

Queries the Cryptography key to retrieve the machine's unique MachineGuid — a technique used by Shark malware (Lyceum group) for victim identification included in C2 beacons — followed by queries to LSA configuration settings as performed by HOPLIGHT (Lazarus Group). This simulates the combined target fingerprinting and security posture enumeration pattern seen in APT-attributed intrusions.

Command

powershell 
reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid & reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel & reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v NoLMHash

Expected Telemetry

Sysmon Event ID 1: Three sequential Process Create events for reg.exe with CommandLine targeting 'Cryptography', 'Control\Lsa' keys respectively. Security Event ID 4688 with command line if auditing enabled. Consecutive execution timestamps within milliseconds of each other, consistent with scripted automated enumeration rather than manual administrative queries.

Expected Detection

Alert fires on both key paths: 'Microsoft\Cryptography' and 'CurrentControlSet\Control\Lsa' both match SensitiveRegistryPaths. KQL: SensitivePath=true, QueryType='reg.exe' for all three events. Temporal clustering of multiple sensitive path queries from the same process session is a high-confidence hunting indicator.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1552.002Credentials in RegistryT1082System Information DiscoveryT1518Software DiscoveryT1518.001Security Software DiscoveryT1057Process DiscoveryT1059.001PowerShellT1059.003Windows Command ShellT1562.001Disable or Modify ToolsT1547.001Registry Run Keys / Startup FolderT1021.001Remote Desktop Protocol

Same Tactic: Discovery

Popular Detections