Windows: regedit.exe imports .reg via an alternate data stream (ADS)

Alerts when regedit.exe is used to import a .reg file using an alternate data stream pattern in the command line.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Oddvar Moe, Sander Wiebing, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-12
Updated: 2026-07-30

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of regedit.exe where the command line indicates importing a .reg file ("/i" and ".reg") while also matching an alternate data stream pattern (a colon not followed by a space or backslash). Importing registry content through an ADS can be used to obscure file content and delivery artifacts while still leveraging a legitimate Windows utility. It relies on process creation telemetry including Image or OriginalFileName and CommandLine fields.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Suspicious Loopback Proxy Server Configured via Registry (via registry_set)

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm

Malicious Gh0stBins RAT Registry Marker HHClient

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

Windows: regedit.exe imports .reg via an alternate data stream (ADS)

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-regedit-exe-imports-reg-via-an-alternate-data-stream-ads-0b80ade5

title: "Windows: regedit.exe imports .reg via an alternate data stream (ADS)"
id: cc396d9f-32e6-4e4b-8c11-c41812c1190f
related:
  - id: 73bba97f-a82d-42ce-b315-9182e76c57b1
    type: similar
  - id: 0b80ade5-6997-4b1d-99a1-71701778ea61
    type: derived
status: test
description: This rule flags process executions of regedit.exe where the command line indicates importing a .reg file ("/i" and ".reg") while also matching an alternate data stream pattern (a colon not followed by a space or backslash). Importing registry content through an ADS can be used to obscure file content and delivery artifacts while still leveraging a legitimate Windows utility. It relies on process creation telemetry including Image or OriginalFileName and CommandLine fields.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml
author: Oddvar Moe, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2024-03-13
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \regedit.exe
    - OriginalFileName: REGEDIT.EXE
  selection_cli:
    CommandLine|contains:
      - " /i "
      - .reg
    CommandLine|re: :[^ \\]
  filter:
    CommandLine|contains|windash:
      - " -e "
      - " -a "
      - " -c "
  condition: all of selection_* and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL