H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Query Registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

120 recorded

Relationships

mapped-to
from Collect Data from Registries
Technique
uses
from ADVSTORESHELL
Malware
uses
from APT32
Group
uses
from APT39
Group
uses
from APT41
Group
uses
from Attor
Malware
uses
from Azorult
Malware
uses
from BabyShark
Malware
uses
from BACKSPACE
Malware
uses
from Bankshot
Malware
uses
from Bazar
Malware
uses
from BendyBear
Malware
uses
from Bisonal
Malware
uses
from BitPaymer
Malware
uses
from BlackByte
Group
uses
from BlackByte Ransomware
Malware
uses
from Brave Prince
Malware
uses
from Bumblebee
Malware
uses
from Carbanak
Malware
uses
from Carberp
Malware
uses
from Carbon
Malware
uses
from Cardinal RAT
Malware
uses
from CharmPower
Malware
uses
from Chimera
Group
uses
from CHOPSTICK
Malware
uses
from Clambling
Malware
uses
from Cobalt Strike
Malware
uses
from ComRAT
Malware
uses
from Crimson
Malware
uses
from Daggerfly
Group
uses
from DarkWatchman
Malware
uses
from Denis
Malware
uses
from Derusbi
Malware
uses
from DownPaper
Malware
uses
from Dragonfly
Group
uses
from Dtrack
Malware
uses
from DUSTTRAP
Malware
uses
from Epic
Malware
uses
from FatDuke
Malware
uses
from FELIXROOT
Malware
uses
from FinFisher
Malware
uses
from Fox Kitten
Group
uses
from FunnyDream
Malware
uses
from Gamaredon Group
Group
uses
from Gelsemium
Malware
uses
from gh0st RAT
Malware
uses
from Gold Dragon
Malware
uses
from HOPLIGHT
Malware
uses
from Hydraq
Malware
uses
from Indrik Spider
Group
uses
from Industroyer
Malware
uses
from InvisiMole
Malware
uses
from JPIN
Malware
uses
from Kapeka
Malware
uses
from Kimsuky
Group
uses
from Lazarus Group
Group
uses
from LiteDuke
Malware
uses
from LitePower
Malware
uses
from Lotus Blossom
Group
uses
from Lucifer
Malware
uses
from Mafalda
Malware
uses
from Milan
Malware
uses
from Mori
Malware
uses
from njRAT
Malware
uses
from OilRig
Group
uses
from Operation Wocao
Campaign
uses
from OSInfo
Malware
uses
from PcShare
Tool
uses
from Pillowmint
Malware
uses
from PlugX
Malware
uses
from POWERSOURCE
Malware
uses
from PowerSploit
Tool
uses
from POWRUNER
Malware
uses
from Proxysvc
Malware
uses
from PUBLOAD
Malware
uses
from Qilin
Malware
uses
from QUADAGENT
Malware
uses
from QUIETCANARY
Malware
uses
from Raccoon Stealer
Malware
uses
from RATANKBA
Malware
uses
from Reaver
Malware
uses
from RedLine Stealer
Malware
uses
from Reg
Tool
uses
from Remcos
Tool
uses
from REvil
Malware
uses
from Rising Sun
Malware
uses
from ROKRAT
Malware
uses
from Saint Bot
Malware
uses
from Samurai
Malware
uses
from Shamoon
Malware
uses
from Shark
Malware
uses
from Sibot
Malware
uses
from SILENTTRINITY
Tool
uses
from SodaMaster
Malware
uses
from Stealth Falcon
Group
uses
from StoneDrill
Malware
uses
from Stuxnet
Malware
uses
from SUNBURST
Malware
uses
from SVCReady
Malware
uses
from SynAck
Malware
uses
from Taidoor
Malware
uses
from TEARDROP
Malware
uses
from Threat Group-3390
Group
uses
from TinyTurla
Malware
uses
from TRANSLATEXT
Malware
uses
from Turla
Group
uses
from Uroburos
Malware
uses
from Ursnif
Malware
uses
from Valak
Malware
uses
from Volgmer
Malware
uses
from Volt Typhoon
Group
uses
from WastedLocker
Malware
uses
from Waterbear
Malware
uses
from WINDSHIELD
Malware
uses
from Woody RAT
Malware
uses
from Zebrocy
Malware
uses
from Zeus Panda
Malware
uses
from ZIRCONIUM
Group
uses
from ZxShell
Malware
uses
from ZxxZ
Malware
2 external

References

mitre-attack
T1012
open
Wikipedia Windows Registry
https://en.wikipedia.org/wiki/Windows_Registry
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance