Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a live sigma-cli backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,707
Ready to search
Backends
17
Live from sigconverter.io
CLI Versions
10
Newest: 2.0.2
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
System Information Discovery via Registry Queries
Target Profile
Splunk
Splunk SPL & tstats data model queries
Format Mode
Default
Plain SPL queries
Conversion Output
System Information Discovery via Registry Queries
Using Splunk · Default · sigma-cli 2.0.2
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion2.0.2
title: System Information Discovery via Registry Queries
id: 0022869c-49f7-4ff2-ba03-85ac42ddac58
status: experimental
description: Detects attempts to query system information directly from the Windows Registry.
references:
- https://cert.gov.ua/article/6277849
- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md
author: lazarg
date: 2025-06-12
modified: 2025-10-25
tags:
- attack.discovery
- attack.t1082
logsource:
category: process_creation
product: windows
detection:
selection_cmd_reg:
Image|endswith: '\reg.exe'
CommandLine|contains: 'query'
CommandLine|contains|windash: '-v'
selection_cmd_powershell:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains:
- 'Get-ItemPropertyValue'
- 'gpv'
selection_keys:
CommandLine|contains:
- '\SOFTWARE\Microsoft\Windows Defender' # Details about defender state
- '\SOFTWARE\Microsoft\Windows NT\CurrentVersion' # Provides details about the OS
- '\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' # Lists installed programs
- '\SYSTEM\CurrentControlSet\Control\TimeZoneInformation' # Contains time zone details
- '\SYSTEM\CurrentControlSet\Services' # Details about existing services
condition: 1 of selection_cmd_* and selection_keys
falsepositives:
- Unlikely
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml
simulation:
- type: atomic-red-team
name: System Information Discovery
technique: T1010
atomic_guid: 66703791-c902-4560-8770-42b8a91f7667
- type: atomic-red-team
name: Discover OS Product Name via Registry
technique: T1082
atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7
- type: atomic-red-team
name: Discover OS Build Number via Registry
technique: T1082
atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml