Query Registry using Built-in Tools

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Query Registry using Built-in Tools

This rule identifies the execution of commands that can be used to query the Windows Registry. Adversaries may query the registry to gain situational awareness about the host, like installed security software, programs and settings.

Rule type: eql

Rule indices:

logs-endpoint.events.process-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

Domain: Endpoint
OS: Windows
Use Case: Threat Detection
Tactic: Discovery
Rule Type: BBR
Data Source: Elastic Defend
Rule Type: Event Correlation (EQL)
Platform: Windows

Version: 110

Rule authors:

Elastic

Rule license: Elastic License v2

Rule query

edit

process where host.os.type == "windows" and event.type == "start" and
  (
    (process.name : "reg.exe" and process.args : "query") or
    (
      process.name : ("powershell.exe", "powershell_ise.exe", "pwsh.exe") and
      process.args : ("get-childitem", "gci", "dir", "ls", "get-item", "gi", "get-itemproperty", "gp") and
      process.args : ("hkcu", "hkey_current_user", "hkey_local_machine", "hklm", "registry::*")
    )
  ) and
  not process.command_line : (
    "C:\\Windows\\system32\\reg.exe  query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64",
    "reg  query \"HKLM\\Software\\WOW6432Node\\Npcap\" /ve  "
  )

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Discovery
- ID: TA0007
- Reference URL: https://attack.mitre.org/tactics/TA0007/
Technique:
- Name: Query Registry
- ID: T1012
- Reference URL: https://attack.mitre.org/techniques/T1012/

« Quarantine Attrib Removed by Unsigned or Untrusted Process Quick Assist Full Control Sharing Mode Enabled »