T1012: Query Registry
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
The Registry contains a significant amount of information about the operating system, configuration, software, and security.[1] Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Analyst context for executives and security teams
Query Registry is a Windows discovery behavior where an intruder or malware reads Registry data to understand the host, installed software, configuration, and security posture before deciding what to do next. For leaders, its value is as an early warning and investigation pivot: by itself it may look like normal administration, but in the wrong process context it can show adversary decision-making before lateral movement, persistence, or payload selection.
Executive priority
Treat this as a coverage-validation item for Windows endpoint visibility and incident triage. Because ATT&CK associates this technique with many campaigns, groups, and Windows malware families, executives should ask whether the SOC can distinguish routine Registry access from discovery performed by suspicious tools or processes. This matters for resilience because discovery often precedes follow-on action; weak visibility can delay containment decisions and reduce confidence in audit evidence after an incident.
Technical view
This is an Enterprise ATT&CK discovery technique for Windows. MITRE does not provide official detection text for T1012, but the relationship to DET0209, Detection of Registry Query for Environmental Discovery, indicates a detection-strategy context. SOC and detection teams should validate monitoring for Registry query activity, especially use of Reg.exe and other processes accessing Registry locations that reveal operating system, software, configuration, or security details. Prioritize correlation with process lineage, command-line arguments, user context, host role, and nearby discovery behaviors rather than alerting on all Registry reads.
Likely telemetry
- Windows endpoint process creation events, including image name, command line, parent process, user, and working directory
- Registry access or query telemetry from EDR, Sysmon-style event sources, or native Windows auditing where enabled
- Execution of Reg.exe and other utilities or binaries that can access the Registry
- Host inventory and software/configuration baselines to identify unusual discovery targets
- Timeline context around adjacent discovery activity, malware execution, or remote access tooling
Detection direction
- Validate coverage against DET0209-style logic for environmental discovery via Registry queries.
- Tune detections around suspicious process context: unusual parent processes, scripting or malware-like process chains, unexpected users, or Registry queries from temporary or user-writable paths.
- Reduce false positives by accounting for legitimate administration, software inventory, endpoint management, installers, and security tools that query the Registry frequently.
- Use relationship context as prioritization, not attribution: ATT&CK links this technique to multiple groups, a campaign, and Windows malware such as Taidoor, PlugX, and Derusbi, but local evidence is required before making an actor assessment.
- Correlate Registry queries with subsequent behavior, since the technique is often useful because it informs later adversary decisions.
Mitigation priorities
- Ensure Windows endpoint logging and EDR collection include process execution and, where practical, Registry query visibility.
- Baseline legitimate Registry-querying activity from management, inventory, security, and installation tools before enabling high-severity alerts.
- Apply least privilege and application control principles to reduce unnecessary execution of discovery utilities by untrusted users or processes.
- Integrate Registry discovery findings into incident response playbooks so analysts check what information was queried and what follow-on actions occurred.
- Use this technique as evidence in control validation for SOC readiness, endpoint visibility, and Windows configuration monitoring rather than as a standalone indicator of compromise.
Analyst notes and limits
The supplied ATT&CK object is a technique-level entry with no official MITRE detection text and no mitigations listed. The practical value comes from validating whether Windows telemetry can show who queried the Registry, from what process, and in what sequence. The broad set of related groups, campaign, and software demonstrates common adversary utility, but it should not be treated as attribution by itself.
This take is limited to the supplied ATT&CK fields, external references, and relationships. It does not assert active exploitation, customer exposure, guaranteed detection, or non-Windows platform relevance. Effective detection depends on local endpoint telemetry, retention, baselines, and IR context.
Query Registry
Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
The Registry contains a significant amount of information about the operating system, configuration, software, and security.[1] Information can easily be queried using the Reg utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0128: ZIRCONIUM
G0027: Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
G0050: APT32
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]
G0035: Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
G0010: Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
G0094: Kimsuky
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]
Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]
DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.
G0038: Stealth Falcon
Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. [1]
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
G1043: BlackByte
BlackByte is a ransomware threat actor operating since at least 2021. BlackByte is associated with several versions of ransomware also labeled BlackByte Ransomware. BlackByte ransomware operations initially used a common encryption key allowing for the development of a universal decryptor, but subsequent versions such as BlackByte 2.0 Ransomware use more robust encryption mechanisms. BlackByte is notable for operations targeting critical infrastructure entities among other targets across North America.[1][2][3][4][5]
S0091: Epic
S1159: DUSTTRAP
S0589: Sibot
Sibot is dual-purpose malware written in VBScript designed to achieve persistence on a compromised system as well as download and execute additional payloads. Microsoft discovered three Sibot variants in early 2021 during its investigation of APT29 and the SolarWinds Compromise.[1]
S0512: FatDuke
S0203: Hydraq
S1064: SVCReady
S0560: TEARDROP
TEARDROP is a memory-only dropper that was discovered on some victim machines during investigations related to the SolarWinds Compromise. It was likely used by APT29 since at least May 2020.[1][2]
S0376: HOPLIGHT
S1019: Shark
S1180: BlackByte Ransomware
BlackByte Ransomware is uniquely associated with BlackByte operations. BlackByte Ransomware used a common key for infections, allowing for the creation of a universal decryptor.[1][2] BlackByte Ransomware was replaced in BlackByte operations by BlackByte 2.0 Ransomware by 2023.[3][4]
S0344: Azorult
Azorult is a commercial Trojan that is used to steal information from compromised hosts. Azorult has been observed in the wild as early as 2016. In July 2018, Azorult was seen used in a spearphishing campaign against targets in North America. Azorult has been seen used for cryptocurrency theft. [1][2]
S0660: Clambling
Clambling is a modular backdoor written in C++ that has been used by Threat Group-3390 since at least 2017.[1]
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 581a53e73121… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Wikipedia Windows Registry
Wikipedia. (n.d.). Windows Registry. Retrieved February 2, 2015.
Open source URL -
[2]
mitre-attack T1012Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.