---
title: Query Registry via reg.exe
description: Enumeration or discovery of the Windows registry using reg.exe. This information can be used to perform follow-on activities. Rule type: eql Rule indices:...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/_deprecated/discovery_query_registry_via_reg
products:
  - Elastic Security
---

# Query Registry via reg.exe
<warning>
  This rule has been deprecated as of 2021/04/15.
</warning>

Enumeration or discovery of the Windows registry using reg.exe. This information can be used to perform follow-on
activities.
**Rule type**: eql
**Rule indices**:
- logs-endpoint.events.*
- winlogbeat-*
- logs-windows.*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
**Tags**:
- Elastic
- Host
- Windows
- Threat Detection
- Discovery

**Version**: 100
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```eql
process where event.type in ("start", "process_started") and
  (process.name : "reg.exe" or process.pe.original_file_name == "reg.exe") and
  process.args == "query"
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Discovery
  - Id: TA0007
  - Reference URL: [[https://attack.mitre.org/tactics/TA0007/](https://attack.mitre.org/tactics/TA0007/)](https://attack.mitre.org/tactics/TA0007/)
- Technique:
  - Name: Query Registry
  - Id: T1012
  - Reference URL: [[https://attack.mitre.org/techniques/T1012/](https://attack.mitre.org/techniques/T1012/)](https://attack.mitre.org/techniques/T1012/)