BeepRAT Registry Query for OS Version and System Profiling (T1012/T1082)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects read access attempts to the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' registry key. Adversaries often query this key during the reconnaissance phase to identify the specific version, build number, and installation details of the host operating system, which aids in tailoring further exploitation or post-exploitation activities.