ATT&CK coverage › Technique

Query Registry T1012

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Events covered

3 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4656A handle to an object was requested.
Security-Auditing4663An attempt was made to access an object.

Authoring guide

Patterns shared across the 19 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (13 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventID9eq 94663
TargetFilename8eq 7, in 1"*\\AppData\\Local\\Google\\Chrome\\User..., "*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State", "*\\AppData\\Local\\Google\\Chrome\\User..., "*:\\Windows\\System32\\drivers\\etc\\hosts", "*\\discord\\Local Storage\\leveldb*"
Image5ends_with 5\regedit.exe, \PCHunter32.exe, \PCHunter64.exe, \reg.exe, \wmic.exe
OriginalFileName5eq 5REGEDIT.EXE, PCHunter.exe, reg.exe, wmic.exe
ObjectName4eq 2, ends_with 2\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft..., \REGISTRY\MACHINE\SOFTWARE\Microsoft\ADHealthAgent, \SAM, lsa\GBG, lsa\Skew1
ObjectType4eq 4Key, key
CommandLine4match 4, ends_with 2hkey_local_machine, hklm, \security, currentcontrolset\services, currentVersion\policies\explorer\run
process_name3match 2, ne 1Microsoft.Identity.Health.Adfs.PshSurrogate.exe, Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe, Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe, *\\discord.exe
Hashes1match 1IMPHASH=444D210CEA1FF8112F256A4997EED7FF, SHA1=3FB89787CB97D902780DA080545584D97FB1C2EB, SHA256=55F041BF4E78E9BFA6D4EE68BE40E496CE3A1353E1CA430659...
Description1eq 1Epoolsoft Windows Information View Tools
isMalicious1eq 11
isAllowed1eq 1"false"
is_valid_browser_path1eq 1"false"

Top indicator values (60 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
EventIDeq4663916
ObjectTypeeqKey33
process_namematchMicrosoft.Identity.Health.Adfs.PshSurrogate.exe22
process_namematchMicrosoft.Identity.Health.Common.Clients.ResourceMonitor.exe22
process_namematchMicrosoft.Identity.Health.Adfs.InsightsService.exe22
process_namematchMicrosoft.Identity.Health.Adfs.DiagnosticsAgent.exe22
process_namematchMicrosoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe22
Imageends_with\regedit.exe28
CommandLinematch -E 22
CommandLineends_with\system22
CommandLinematchhkey_local_machine23
OriginalFileNameeqREGEDIT.EXE24
CommandLinematchhklm23
CommandLineends_with\sam22
CommandLineends_with\security22
ObjectNameeq\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent1
ObjectNameeq\REGISTRY\MACHINE\SOFTWARE\Microsoft\ADHealthAgent1
HashesmatchSHA1=3FB89787CB97D902780DA080545584D97FB1C2EB1
HashesmatchIMPHASH=444D210CEA1FF8112F256A4997EED7FF1
HashesmatchMD5=228DD0C2E6287547E26FFBD973A40F141

Common exclusions (16 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
process_namein"*:\\Windows\\explorer.exe"4
process_namein"*\\chrome.exe"3
process_namein"*:\\Windows\\SysWow64\\*"2
process_namein"*:\\Windows\\System32\\*"2
process_namein"*:\\Windows\\System32\\dllhost.exe"1
process_namein"*:\\Windows\\System32\\svchost.exe"1
process_namein"*:\\Windows\\SysWow64\\SearchIndexer.exe"1
process_namein"*:\\Windows\\System32\\lsass.exe"1
process_namein"*:\\Windows\\System32\\services.exe"1
process_namein"*:\\Windows\\System32\\SearchIndexer.exe"1
process_namein"*:\\Windows\\SysWow64\\svchost.exe"1
process_namein"*:\\Windows\\*"1
process_namein"*:\\Program Files*"1
process_namein"*:\\Program Files\\*"1
process_namein*:\\Windows\\WinSxS\\*1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 9 rules

Splunk 9 rules

Kusto Query Language 1 rule