Windows regedit.exe exports a registry key into an alternate data stream
Flags regedit.exe executions where the process image ends with '\regedit.exe', consistent with exporting Registry data to an alternate data stream.
- Product
- windows
- Category
- create_stream_hash
- Author
- Oddvar Moe, Sander Wiebing, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-07
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches executions of regedit.exe, specifically where the process image path ends with \regedit.exe, indicating an attempt to export a registry key while hiding it in a specified alternate data stream. Attackers may use this technique to reduce visibility of sensitive data in standard file views by placing it in alternate streams. The detection relies on Windows process creation telemetry that captures the executable path used to run regedit.exe.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows regedit.exe exports a registry key into an alternate data stream
id: e12fcdfa-4895-47db-b41b-938cb7e38d9c
status: test
description: This rule matches executions of regedit.exe, specifically where the process image path ends with \regedit.exe, indicating an attempt to export a registry key while hiding it in a specified alternate data stream. Attackers may use this technique to reduce visibility of sensitive data in standard file views by placing it in alternate streams. The detection relies on Windows process creation telemetry that captures the executable path used to run regedit.exe.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Regedit/
- https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml
author: Oddvar Moe, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2021-11-27
tags:
- attack.stealth
- attack.t1564.004
logsource:
product: windows
category: create_stream_hash
detection:
selection:
Image|endswith: \regedit.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 0d7a9363-af70-4e7b-a3b7-1a176b7fbe84
type: derived