Regedit.exe

Commands

1. ADSUser T1564.004

   Hide registry data in alternate data stream

   regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey

   Export the target Registry key to the specified .REG file.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

2. ADSUser T1564.004

   Import hidden registry data from alternate data stream

   regedit {PATH_ABSOLUTE}:regfile.reg

   Import the target .REG file into the Registry.

   os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml
• IOCregedit.exe reading and writing to alternate data stream
• IOCregedit.exe should normally not be executed by end-users

Resources

• https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f