LOL · Binary

Regedit.exe

2 techniquesWindowsLOLBASGPL-3.0

Defense EvasionFile WriteWindows

Export the target Registry key to the specified .REG file.

Use Hide registry data in alternate data stream

regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey

Evidence: Upstream reference
Environment: Local host
Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml
IOC: regedit.exe reading and writing to alternate data stream
IOC: regedit.exe should normally not be executed by end-users
Refs: gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
lolbas-project.github.io/lolbas/Binaries/Regedit/

Defense EvasionFile WriteWindows

Import the target .REG file into the Registry.

Use Import hidden registry data from alternate data stream

regedit {PATH_ABSOLUTE}:regfile.reg

Evidence: Upstream reference
Environment: Local host
Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml
IOC: regedit.exe reading and writing to alternate data stream
IOC: regedit.exe should normally not be executed by end-users
Refs: gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
lolbas-project.github.io/lolbas/Binaries/Regedit/