Query Registry (T1012) is a discovery technique for Windows. Adversaries interact with the registry to gather information about the system, its configuration and installed software.
How attackers use it
The registry holds a lot about the operating system, software and security settings. MITRE says information can easily be queried with the Reg utility, though other ways exist. Some of what they find helps further the operation. MITRE adds that adversaries may use it during automated discovery to shape follow-on behavior, including whether they fully infect the target or attempt specific actions.
How to detect it
MITRE's analytic is registry read access linked to suspicious or non-interactive processes querying system configuration, installed software or security settings.
Registry reads are extremely common, so logging all of them is impractical. Choose narrow targets instead. Audit reads of the keys that list installed security products, or that hold sensitive configuration. Add process creation logging with command lines so reg.exe queries appear along with their parent process. A reg query launched by an office application or a script host is more interesting than one launched by an administrator at a console.
How to reduce the risk
MITRE lists no mitigations, since the technique uses a normal operating system feature. Reduce what is available to read: avoid storing secrets in registry values, and limit local access so fewer users can run tools at all.
Which keys deserve attention
A few groups of keys give adversaries useful intelligence: those that list installed software, those that describe security settings, and those that control autostart behavior. MITRE says the information shapes follow-on behavior, so these are the ones to audit.
Do not try to log every registry read. Pick the sensitive keys, enable auditing on them, and exclude the system components and agents that read them all the time. What remains is a small stream you can review.
Add a rule on volume. A single process that reads many unrelated keys in a minute is behaving like a survey, not like a normal program.
Quick check
How do you log registry queries without overwhelming your SIEM?
Audit a short list of sensitive keys and combine process creation logs for reg.exe with the parent process, instead of logging every registry read.
