Configuration and Service Reconnaissance via Reg.exe

Adversaries frequently leverage the legitimate Windows utility reg.exe to perform reconnaissance activities. By querying sensitive registry keys, an attacker can enumerate installed software, system configuration details, and potential persistence mechanisms. This behavior is commonly observed in the early stages of a post-compromise environment, as it allows threat actors to map out the system's security posture and identify interesting services or applications for further exploitation. Security teams should monitor for the combination of reg.exe execution with specific command-line arguments targeting keys related to auto-start locations, service configurations, and system policies.

Attack Chain

1. Initial access is gained to the target system via a user-level shell or remote access tool.
2. The attacker identifies the reg.exe utility in the system path.
3. The attacker executes reg query to target specific registry hives, such as HKCU or HKLM.
4. The query focuses on paths like currentVersion\run to identify persistence mechanisms.
5. The attacker proceeds to query currentcontrolset\services to identify installed system services.
6. The gathered registry data is exfiltrated or parsed locally to identify future targets.
7. The final objective includes leveraging the discovered information for privilege escalation or lateral movement.

Impact

Successful reconnaissance allows an attacker to build an accurate profile of the target environment, enabling the identification of weak configurations, security product paths, and persistent entry points. This data significantly reduces the time required for an attacker to move from initial access to full domain compromise.

Recommendation

• Deploy the provided Sigma rule to detect reg.exe usage targeting sensitive registry hives in your SIEM.
• Establish an allowlist of administrative tools or management scripts that legitimately use reg.exe to query system configurations to reduce false positives.
• Audit endpoint telemetry for frequent reg query commands from non-administrative service accounts.