Used by Windows to manipulate registry Located at: C:\Windows\regedit.exe.
regeditregeditSandbox: execFile · Timeout: 30s
system.file.alternate-data-stream Outputs
process.output Command execution output
filesystem_write Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Export the target Registry key to the specified .REG file. (Hide registry data in alternate data stream)
regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKeyImport the target .REG file into the Registry. (Import hidden registry data from alternate data stream)
regedit {PATH_ABSOLUTE}:regfile.reg| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml |
| ioc | regedit.exe reading and writing to alternate data stream |
| ioc | regedit.exe should normally not be executed by end-users |
regedit is a Windows LOLBin. Used by Windows to manipulate registry Located at: C:\Windows\regedit.exe.