Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1012

Query Registry

Windowsnothing on this site yetT1012 on attack.mitre.org

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Registry Query for Environmental Discovery

  • Registry read access associated with suspicious or non-interactive processes querying system config, installed software, or security settings.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.