Windows: regedit.exe imports .reg via an alternate data stream (ADS)

title: "Windows: regedit.exe imports .reg via an alternate data stream (ADS)"
id: cc396d9f-32e6-4e4b-8c11-c41812c1190f
related:
  - id: 73bba97f-a82d-42ce-b315-9182e76c57b1
    type: similar
  - id: 0b80ade5-6997-4b1d-99a1-71701778ea61
    type: derived
status: test
description: This rule flags process executions of regedit.exe where the command line indicates importing a .reg file ("/i" and ".reg") while also matching an alternate data stream pattern (a colon not followed by a space or backslash). Importing registry content through an ADS can be used to obscure file content and delivery artifacts while still leveraging a legitimate Windows utility. It relies on process creation telemetry including Image or OriginalFileName and CommandLine fields.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml
author: Oddvar Moe, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2024-03-13
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \regedit.exe
    - OriginalFileName: REGEDIT.EXE
  selection_cli:
    CommandLine|contains:
      - " /i "
      - .reg
    CommandLine|re: :[^ \\]
  filter:
    CommandLine|contains|windash:
      - " -e "
      - " -a "
      - " -c "
  condition: all of selection_* and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1