huntrule

regedit.exe Exports a Registry Key into an Alternate Data Stream (Windows)

Flags regedit.exe executions where the process image ends with '\regedit.exe', consistent with exporting Registry data to an alternate data stream.

FreeUnreviewedSigmahighv1
title: regedit.exe Exports a Registry Key into an Alternate Data Stream (Windows)
id: e12fcdfa-4895-47db-b41b-938cb7e38d9c
status: test
description: This rule identifies execution of regedit.exe when the image path ends with '\regedit.exe'. It is intended to catch attempts to export a Registry key and conceal the resulting data in a specified alternate data stream, a technique used to improve stealth. The detection relies on process creation telemetry that provides the process image path.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml
author: Oddvar Moe, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Image|endswith: \regedit.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0d7a9363-af70-4e7b-a3b7-1a176b7fbe84
    type: derived

What it detects

This rule identifies execution of regedit.exe when the image path ends with '\regedit.exe'. It is intended to catch attempts to export a Registry key and conceal the resulting data in a specified alternate data stream, a technique used to improve stealth. The detection relies on process creation telemetry that provides the process image path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.