Registry queried for host, software or security configuration

Siemphony@siemphonylowT1012unverified

Matches a registry read issued on a command line — reg query, or the PowerShell registry-provider cmdlets — against keys that describe the host, its installed software and its security posture, which is MITRE's TargetRegistryPath knob populated here with the OS version, uninstall, machine GUID, BIOS, disk enumeration, Defender, UAC and Terminal Server keys. The registry categories the brief also offers cannot express this at all: Sysmon EventID 13 records a value being written and 14 a key being renamed, so a query leaves no registry event behind and a rule built on registry_set could never fire. A read performed through the API without a command line — a compiled implant, or a .NET call buried inside a longer script — is invisible here, so a quiet result is not evidence that nothing enumerated the registry. Discovery of this kind is what ordinary administration and inventory tooling does all day, which is why the level below is set for a hunting input rather than an alert. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0209, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "reg query" or ProcessCommandLine contains "reg.exe query" or ProcessCommandLine contains "Get-ItemProperty" or ProcessCommandLine contains "Get-ItemPropertyValue" or ProcessCommandLine contains "Get-ChildItem HKLM" or ProcessCommandLine contains "Get-ChildItem -Path HKLM") and (ProcessCommandLine contains "Windows NT\\CurrentVersion" or ProcessCommandLine contains "CurrentVersion\\Uninstall" or ProcessCommandLine contains "CurrentVersion\\Policies\\System" or ProcessCommandLine contains "Microsoft\\Cryptography" or ProcessCommandLine contains "Microsoft\\Windows Defender" or ProcessCommandLine contains "Control\\SystemInformation" or ProcessCommandLine contains "Control\\Terminal Server" or ProcessCommandLine contains "HARDWARE\\DESCRIPTION\\System" or ProcessCommandLine contains "Services\\Disk\\Enum"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*reg query*" OR CommandLine="*reg.exe query*" OR CommandLine="*Get-ItemProperty*" OR CommandLine="*Get-ItemPropertyValue*" OR CommandLine="*Get-ChildItem HKLM*" OR CommandLine="*Get-ChildItem -Path HKLM*") AND (CommandLine="*Windows NT\\CurrentVersion*" OR CommandLine="*CurrentVersion\\Uninstall*" OR CommandLine="*CurrentVersion\\Policies\\System*" OR CommandLine="*Microsoft\\Cryptography*" OR CommandLine="*Microsoft\\Windows Defender*" OR CommandLine="*Control\\SystemInformation*" OR CommandLine="*Control\\Terminal Server*" OR CommandLine="*HARDWARE\\DESCRIPTION\\System*" OR CommandLine="*Services\\Disk\\Enum*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*reg query*" OR TO_LOWER(process.command_line) LIKE "*reg.exe query*" OR TO_LOWER(process.command_line) LIKE "*get-itemproperty*" OR TO_LOWER(process.command_line) LIKE "*get-itempropertyvalue*" OR TO_LOWER(process.command_line) LIKE "*get-childitem hklm*" OR TO_LOWER(process.command_line) LIKE "*get-childitem -path hklm*") AND (TO_LOWER(process.command_line) LIKE "*windows nt\\\\currentversion*" OR TO_LOWER(process.command_line) LIKE "*currentversion\\\\uninstall*" OR TO_LOWER(process.command_line) LIKE "*currentversion\\\\policies\\\\system*" OR TO_LOWER(process.command_line) LIKE "*microsoft\\\\cryptography*" OR TO_LOWER(process.command_line) LIKE "*microsoft\\\\windows defender*" OR TO_LOWER(process.command_line) LIKE "*control\\\\systeminformation*" OR TO_LOWER(process.command_line) LIKE "*control\\\\terminal server*" OR TO_LOWER(process.command_line) LIKE "*hardware\\\\description\\\\system*" OR TO_LOWER(process.command_line) LIKE "*services\\\\disk\\\\enum*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(reg query|reg\.exe query|Get-ItemProperty|Get-ItemPropertyValue|Get-ChildItem HKLM|Get-ChildItem -Path HKLM)</field>    <field name="CommandLine" type="pcre2">(?i)(Windows NT\\CurrentVersion|CurrentVersion\\Uninstall|CurrentVersion\\Policies\\System|Microsoft\\Cryptography|Microsoft\\Windows Defender|Control\\SystemInformation|Control\\Terminal Server|HARDWARE\\DESCRIPTION\\System|Services\\Disk\\Enum)</field>    <description>Registry queried for host, software or security configuration</description>    <mitre>      <id>T1012</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2c4526fb-8cc6-4933-93e8-d4cac2a711b6

ATT&CKT1012

T1012Query Registry

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

AN0589 describes registry read access from suspicious or non-interactive processes querying system config, installed software, or security settings. This rule only catches the command-line-visible act of issuing the query — reg query or a PowerShell registry cmdlet against a meaningful key. It cannot see what the query returned, or what the process did with that answer. That's a precursor signal, and an intentional one: Sysmon EventID 13/14 (registry_set/registry_rename) only fire on writes and renames, so a pure read leaves no registry event to hook. The only place a query is visible at all is the command line that issued it, which is why this rule lives in process_creation instead of the registry categories the brief also lists.

02 · Telemetry you need

logsource: category: process_creation, product: windows, with CommandLine populated. On Sysmon EventID 1 that's on by default. Translations.json shows every backend renders this rule (Splunk, Elastic ESQL, Wazuh, and Sentinel against SecurityEvent | where EventID == 4688) — none refuse it. That's deceptive: Sentinel's 4688 path only carries CommandLine if the "Include command line in process creation events" audit sub-policy is enabled, and it's off by default. A render isn't a guarantee of data.

03 · How the logic works

Two selections, ANDed. selection_read matches six contains terms — reg query, reg.exe query, Get-ItemProperty, Get-ItemPropertyValue, Get-ChildItem HKLM, Get-ChildItem -Path HKLM — the read verbs. selection_key matches nine contains terms against key fragments: OS version, Uninstall, Policies\System, Cryptography, Windows Defender, SystemInformation, Terminal Server, hardware description, and disk enumeration. condition: selection_read and selection_key means a bare reg query against an unlisted key won't fire, and reading a listed key without a recognized verb won't either — both halves must be true. The nine-key list populates MITRE's TargetRegistryPath knob; the values are the author's, not MITRE's. Two other knobs the brief offers — ParentProcess and TimeWindow — go untouched here: no parent-process filter is applied, and Sigma has no operator to correlate registry access back to the process that created it within a window, so that half of AN0589 stays unexpressed.

04 · Common false positives

The rule ships at level: low, and the falsepositives list explains why: software inventory, patch-management, and licensing agents enumerate the Uninstall key on a schedule across every managed host — described as the loudest match by a wide margin. Installer bootstrappers checking OS build, compliance scans reading Defender/UAC policy keys, and admins running interactive reg query during support sessions round it out. This is the one rule in the corpus that actually downgraded its level to match its own admitted dominant noise.
The sharper problem is the review's medium finding: fed from Security 4688 without the CommandLine sub-policy enabled, this rule returns zero rows silently. That reads as "clean," but it's actually "blind" — indistinguishable from a host with no queries at all. A sibling rule in this corpus (T1480.001) states its 4104 audit dependency explicitly; this one doesn't.

05 · Detection maturity

tier_1: .** Machine-derived from a MITRE scaffold, never executed against real logs. The audit-policy gap and the missing Get-Item form were found by static review, not by testing against production data — actual hit volume and false-positive rate are unknown until this runs read-only.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Confirm the audit prerequisite before trusting a quiet result: either
Add Get-Item HKLM:\ / Get-Item -Path HKLM:\ to selection_read — the
Command-line matching is blind to WMI's StdRegProv class and direct .NET
Layering MITRE's unused ParentProcess knob (cmd.exe, wscript.exe,

Declared by the author

Software inventory, patch-management and licensing agents, which enumerate the CurrentVersion Uninstall key on every host on a schedule to build an installed-software list. On a managed estate this is a daily event on every machine and is the loudest match by a wide margin, which is what the level reflects.
Installer bootstrappers and application launch scripts that read the Windows NT CurrentVersion key to check the OS build before deciding what to install or which code path to take.
Compliance, hardening and monitoring scans reading the Defender policy keys and the UAC values under CurrentVersion Policies System to report configuration drift, typically once per host per day.
Support sessions where an administrator runs reg query interactively against the hardware description or Terminal Server keys while diagnosing a driver, licensing or remote-desktop problem.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1012, evaluated against their process_creation events.

Share this rule

/u/siemphony/2c4526fb-8cc6-4933-93e8-d4cac2a711b6

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Registry queried for host, software or security configuration

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it