reg

reg.exe is the built-in command-line interface to the Windows Registry. It can query, add, delete, export, and import keys and values — everything regedit does interactively, but scriptable and usable over remote shells where no GUI exists.

Core usage

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
reg query HKCU\Software /s /f "keyword"
reg add HKLM\SOFTWARE\Example /v ValueName /t REG_SZ /d "data"
reg export HKLM\SOFTWARE\Example backup.reg

Registry paths start with a root hive abbreviation:

Abbreviation	Hive
HKLM	HKEY_LOCAL_MACHINE — system-wide settings, services, installed software
HKCU	HKEY_CURRENT_USER — the interactive user’s settings
HKCR	HKEY_CLASSES_ROOT — file associations, COM objects
HKU	HKEY_USERS — all loaded user hives
HKCC	HKEY_CURRENT_CONFIG — current hardware profile

Operational notes

• Recon: reg query maps to MITRE T1012 (Query Registry). Installed software (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall), Run/RunOnce persistence keys, and LSA/secrets locations are all readable this way — see windows-reconnaissance-commands.
• Persistence / privesc: Run and RunOnce keys, service ImagePath values, and IFEO debuggers are all writable with reg add given the right DACLs — the registry side of the escalation primitives described in windows-services.
• Remote: reg query \\HOSTNAME\HKLM\... queries a remote machine’s registry (Remote Registry service must be running).
• PowerShell-native alternative: the HKLM: and HKCU: PSDrives (Get-ItemProperty, Set-ItemProperty) return objects instead of text, but reg.exe works identically in cmd.exe, PowerShell, and non-interactive shells.
• Writing to HKLM requires elevation; HKCU is writable by the owning user — which is why so much userland persistence lives there.

Sources

• Microsoft Learn — reg commands
• MITRE ATT&CK T1012 — Query Registry

Related: windows-reconnaissance-commands, windows-services, windows-file-association-hijacking