Regini.exe — LOLBAS

Defense EvasionFile WriteWindows

Write registry keys from data inside the Alternate data stream.

Use Write to registry

regini.exe {PATH}:hidden.ini

Evidence: Upstream reference
Environment: Local host
Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_ads.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_execution.yml
IOC: regini.exe reading from ADS
Refs: gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
lolbas-project.github.io/lolbas/Binaries/Regini/