Rule Info
Name
System Information Discovery via Registry Queries
Author
lazarg
Description
Detects attempts to query system information directly from the Windows Registry.
Reference
Date
2025-06-12 00:00:00
Modified
None
Id
0022869c-49f7-4ff2-ba03-85ac42ddac58
Tags
attack.discovery attack.t1082
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
lazarg
Merge PR #5243 from @xlazarg - System Information Discovery via Registry Queries
2025-06-12
Scan your endpoints, forensic images or collected files with our portable scanner THOR