Discovery via registry queries detection added

rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml

@@ -0,0 +1,42 @@
+title: System Information Discovery via Registry Queries
+id: 0022869c-49f7-4ff2-ba03-85ac42ddac58
+status: experimental
+description: The rule identifies attempts to query system information directly from the Windows Registry.
+references:
+    - https://cert.gov.ua/article/6277849
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-39---discover-os-product-name-via-registry
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-40---discover-os-build-number-via-registry
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1124/T1124.md#atomic-test-6---discover-system-time-zone-via-registry
+author: lazarg
+date: 2025-01-18
+tags:
+    - attack.discovery
+    - attack.t1082
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_reg:
+        Image|endswith: '\reg.exe'
+        CommandLine|contains: 'query'
+        CommandLine|contains|windash: '-v'
+    selection_powershell:
+        Image|endswith:
+            - '\powershell.exe'
+            - '\pwsh.exe'
+        CommandLine|contains: 
+            - 'Get-ItemPropertyValue'
+            - 'gpv'
+    selection_keys:
+        CommandLine|contains:
+            - '\SYSTEM\CurrentControlSet\Control\TimeZoneInformation' # Contains time zone details
+            - '\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces' # Holds network configuration details
+            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion' # Provides details about the OS
+            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' # Lists installed programs
+            - '\SOFTWARE\Microsoft\Windows Defender' # Details about defender state
+            - '\SYSTEM\CurrentControlSet\Services' # Details about existing services
+            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks' # Details about existing scheduled tasks
+    condition: (selection_reg or selection_powershell) and selection_keys
+falsepositives:
+    - Unlikely
+level: low