Deployable detection rules
1 vendor-native detections · ready to paste into your SIEM · cross-linked to ATT&CK
◈
Detections
1 shown of 1Query Registry via reg.exe
Enumeration or discovery of the Windows registry using reg.exe. This information can be used to perform follow-on
activities.
Show query
process where event.type in ("start", "process_started") and
(process.name : "reg.exe" or process.pe.original_file_name == "reg.exe") and
process.args == "query"
Showing 1-1 of 1