Query Registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

The Registry contains a significant amount of information about the operating system, configuration, software, and security.^[1] Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

ID: T1012

Sub-techniques: No sub-techniques

Tactic: Discovery

Platforms: Windows

Permissions Required: Administrator, SYSTEM, User

Data Sources: Process command-line parameters, Process monitoring, Windows Registry

CAPEC ID: CAPEC-647

Version: 1.2

Created: 31 May 2017

Last Modified: 26 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
ADVSTORESHELL	ADVSTORESHELL can enumerate registry keys.^[16]^[17]
APT32	APT32's backdoor can query the Windows Registry to gather system information. ^[59]
Attor	Attor has opened the registry and performed query searches.^[49]
Azorult	Azorult can check for installed software on the system under the Registry key `Software\Microsoft\Windows\CurrentVersion\Uninstall`.^[25]
BabyShark	BabyShark has executed the `reg query` command for `HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default`.^[48]
BACKSPACE	BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.^[18]
Bankshot	Bankshot searches for certain Registry keys to be configured before executing the payload.^[38]
Brave Prince	Brave Prince gathers information about the Registry.^[5]
Carbanak	Carbanak checks the Registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings` for proxy configurations information.^[32]
Carbon	Carbon enumerates values in the Registry.^[39]
Cardinal RAT	Cardinal RAT contains watchdog functionality that periodically ensures `HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load` is set to point to its executable.^[26]
CHOPSTICK	CHOPSTICK provides access to the Windows Registry, which can be used to gather information.^[23]
ComRAT	ComRAT can check the default browser by querying `HKCR\http\shell\open\command`.^[50]
Denis	Denis queries the Registry for keys and values.^[41]
Derusbi	Derusbi is capable of enumerating Registry keys and values.^[28]
DownPaper	DownPaper searches and reads the value of the Windows Update Registry Run key.^[21]
Dragonfly 2.0	Dragonfly 2.0 queried the Registry to identify victim information.^[52]
Epic	Epic uses the `rem reg query` command to obtain values from Registry keys.^[20]
FELIXROOT	FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.^[11]^[12]
FinFisher	FinFisher queries Registry values as part of its anti-sandbox checks.^[33]^[34]
Gold Dragon	Gold Dragon enumerates registry keys with the command `regkeyenum` and obtains information for the Registry key `HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`.^[5]
HOPLIGHT	A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key `SYSTEM\CurrentControlSet\Control\Lsa Name`.^[42]
Hydraq	Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.^[8]^[9]
InvisiMole	InvisiMole can enumerate Registry values, keys, and data.^[10]
JPIN	JPIN can enumerate Registry keys.^[35]
Lazarus Group	Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:`HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt`.^[54]^[55]^[56]
OilRig	OilRig has used `reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"` on a victim to query the Registry.^[53]
OSInfo	OSInfo queries the registry to look for information about Terminal Services.^[37]
PlugX	PlugX can enumerate and query for information contained within the Windows Registry.^[29]^[30]
POWERSOURCE	POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.^[31]
PowerSploit	PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.^[3]^[4]
POWRUNER	POWRUNER may query the Registry by running `reg query` on a victim.^[13]
Proxysvc	Proxysvc gathers product names from the Registry key: `HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName` and the processor description from the Registry key `HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString`.^[24]
QUADAGENT	QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.^[36]
RATANKBA	RATANKBA uses the command `reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings"`.^[22]
Reaver	Reaver queries the Registry to determine the correct Startup path to use for persistence.^[6]
Reg	Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.^[2]
ROKRAT	ROKRAT accesses the `HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData` Registry key to obtain the System manufacturer value to identify the machine type.^[15]
Shamoon	Shamoon queries several Registry keys to identify hard disk partitions to overwrite.^[27]
Stealth Falcon	Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.^[58]
StoneDrill	StoneDrill has looked in the registry to find the default browser path.^[43]
SynAck	SynAck enumerates Registry keys associated with event logs.^[19]
Threat Group-3390	A Threat Group-3390 tool can read and decrypt stored Registry values.^[57]
Turla	Turla surveys a system upon check-in to discover information in the Windows Registry with the `reg query` command.^[20] Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .^[51]
Ursnif	Ursnif has used Reg to query the Registry for installed programs.^[44]^[45]
Volgmer	Volgmer checks the system for certain Registry keys.^[7]
WINDSHIELD	WINDSHIELD can gather Registry values.^[14]
Zebrocy	Zebrocy executes the `reg query` command to obtain information in the Registry.^[46]
Zeus Panda	Zeus Panda checks for the existence of a Registry key and if it contains certain values.^[40]
ZxShell	ZxShell can query the netsvc group value data located in the svchost group Registry key.^[47]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Interaction with the Windows Registry may come from the command line using utilities such as Reg or through running malware that may interact with the Registry through an API. Command-line invocation of utilities used to query the Registry may be detected through process and command-line monitoring. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Query Registry

Procedure Examples

Mitigations

Detection

References