Description
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Platforms
Threat Groups (19)
| ID | Group | Context |
|---|---|---|
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has used a service account to extract copies of the `Security` Registry hive.(Citation: Mandian... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) queried registry values to determine system language settings.(Citation: Picus BlackByte 2022) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has obtained specific Registry keys and values on a compromised host.(Citation: Talos Kimsuky Nov 202... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has queried the Registry on compromised systems, `reg query hklm\software\`, for information on ... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) queried registry values to determine items such as configured RDP ports and network configurations.(Cit... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has queried the Registry to identify victim information.(Citation: US-CERT TA18-074A) |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s backdoor can query the Windows Registry to gather system information. (Citation: ESET OceanLotus Mar ... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses.(Citatio... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to query the Registry for proxy settings.(Citation: Zscaler APT31 Covid-19 October ... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used various strains of malware to query the Registry.(Citation: FBI FLASH APT39 September 2020) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used <code>reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default”</code> ... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover information in the Windows Registry with the <code>reg query... |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has run commands such as `reg query HKLM\SYSTEM\CurrentControlSet\Services\[service name]\Param... |
| G0038 | Stealth Falcon | [Stealth Falcon](https://attack.mitre.org/groups/G0038) malware attempts to determine the installed version of .NET by querying the Registry.(Citation... |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has queried Registry keys using <code>reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server... |
| G0117 | Fox Kitten | [Fox Kitten](https://attack.mitre.org/groups/G0117) has accessed Registry hives ntuser.dat and UserClass.dat.(Citation: CISA AA20-259A Iran-Based Acto... |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applicatio... |
| G1034 | Daggerfly | [Daggerfly](https://attack.mitre.org/groups/G1034) used [Reg](https://attack.mitre.org/software/S0075) to dump the Security Account Manager (SAM), Sys... |
| G0027 | Threat Group-3390 | A [Threat Group-3390](https://attack.mitre.org/groups/G0027) tool can read and decrypt stored Registry values.(Citation: Nccgroup Emissary Panda May 2... |
Associated Software (99)
| ID | Name | Type | Context |
|---|---|---|---|
| S0242 | SynAck | Malware | [SynAck](https://attack.mitre.org/software/S0242) enumerates Registry keys associated with event logs.(Citation: SecureList SynAck Doppelgänging May 2... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can check the Registry for specific keys.(Citation: Medium Ali Salem Bumblebee April 2022) |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) gathers product names from the Registry key: <code>HKLM\Software\Microsoft\Windows NT\CurrentVersi... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) searches the Registry for indicators of security programs.(Citation: Nicolas Falliere, Liam O Murch... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may query the Registry by running <code>reg query</code> on a victim.(Citation: FireEye APT34 Dec ... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used [Reg](https://attack.mitre.org/software/S0075) to query the Registry for installed programs... |
| S0145 | POWERSOURCE | Malware | [POWERSOURCE](https://attack.mitre.org/software/S0145) queries Registry keys in preparation for setting Run keys to achieve persistence.(Citation: Cis... |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) checks for the existence of a Registry key and if it contains certain values.(Citation: GDATA Ze... |
| S0239 | Bankshot | Malware | [Bankshot](https://attack.mitre.org/software/S0239) searches for certain Registry keys to be configured before executing the payload.(Citation: US-CER... |
| S0252 | Brave Prince | Malware | [Brave Prince](https://attack.mitre.org/software/S0252) gathers information about the Registry.(Citation: McAfee Gold Dragon) |
| S0668 | TinyTurla | Malware | [TinyTurla](https://attack.mitre.org/software/S0668) can query the Registry for its configuration information.(Citation: Talos TinyTurla September 202... |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) can check the Registry for the presence of <code>HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\las... |
| S0560 | TEARDROP | Malware | [TEARDROP](https://attack.mitre.org/software/S0560) checked that <code>HKU\SOFTWARE\Microsoft\CTF</code> existed before decoding its embedded payload.... |
| S1159 | DUSTTRAP | Malware | [DUSTTRAP](https://attack.mitre.org/software/S1159) can enumerate Registry items.(Citation: Google Cloud APT41 2024) |
| S1228 | PUBLOAD | Malware | [PUBLOAD](https://attack.mitre.org/software/S1228) has queried Registry values to identify software using `reg query`.(Citation: Trend Micro MUSTANG P... |
| S1065 | Woody RAT | Malware | [Woody RAT](https://attack.mitre.org/software/S1065) can search registry keys to identify antivirus programs on an compromised host.(Citation: Malware... |
| S1060 | Mafalda | Malware | [Mafalda](https://attack.mitre.org/software/S1060) can enumerate Registry keys with all subkeys and values.(Citation: SentinelLabs Metador Technical A... |
| S0376 | HOPLIGHT | Malware | A variant of [HOPLIGHT](https://attack.mitre.org/software/S0376) hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto'... |
| S0612 | WastedLocker | Malware | [WastedLocker](https://attack.mitre.org/software/S0612) checks for specific registry keys related to the <code>UCOMIEnumConnections</code> and <code>I... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can enumerate Registry values, keys, and data.(Citation: ESET InvisiMole June 2018) |
References
Frequently Asked Questions
What is T1012 (Query Registry)?
T1012 is a MITRE ATT&CK technique named 'Query Registry'. It belongs to the Discovery tactic(s). Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the o...
How can T1012 be detected?
Detection of T1012 (Query Registry) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1012?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1012?
Known threat groups using T1012 include: Indrik Spider, BlackByte, Kimsuky, Volt Typhoon, APT41, Dragonfly, APT32, Gamaredon Group.