Regini.exe
Used to manipulate the registry
Full path
C:\Windows\System32\regini.exe
C:\Windows\SysWOW64\regini.exeCommands
Write to registry
regini.exe {PATH}:hidden.iniWrite registry keys from data inside the Alternate data stream.
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Detection
- Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_ads.yml
- Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_execution.yml
- IOCregini.exe reading from ADS
Resources
acknowledgement: Eli Salem @elisalem9