MITRE ATT&CKtechnique

T1012 Query Registry

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Windows
Version
1.3
Created
2017-05-31

Description

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security. Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (120)

  • S1242 Qilin software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1228 PUBLOAD software (malware)
  • S1201 TRANSLATEXT software (malware)
  • S1190 Kapeka software (malware)
  • S1180 BlackByte Ransomware software (malware)
  • G1043 BlackByte group
  • S1159 DUSTTRAP software (malware)
  • S1148 Raccoon Stealer software (malware)
  • G1034 Daggerfly group
  • S1099 Samurai software (malware)
  • G1017 Volt Typhoon group
  • S1076 QUIETCANARY software (malware)
  • S1065 Woody RAT software (malware)
  • S1064 SVCReady software (malware)
  • S1060 Mafalda software (malware)
  • S1050 PcShare software (tool)
  • S1047 Mori software (malware)
  • C0014 Operation Wocao campaign
  • S1044 FunnyDream software (malware)
  • S1039 Bumblebee software (malware)
  • S1019 Shark software (malware)
  • S1018 Saint Bot software (malware)
  • S1015 Milan software (malware)
  • S1013 ZxxZ software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0680 LitePower software (malware)
  • S0674 CharmPower software (malware)
  • S0673 DarkWatchman software (malware)
  • S0668 TinyTurla software (malware)
Show all 120 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-647 Collect Data from Registries attack pattern

References