Turla surveys a system upon check-in to discover information in the Windows Registry with the "reg query" command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .