Windows regini.exe Used to Modify Registry via Alternate Data Streams (ADS)

title: Windows regini.exe Used to Modify Registry via Alternate Data Streams (ADS)
id: a08b1029-88b2-40e3-8908-65879e224a88
related:
  - id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134
    type: derived
  - id: 77946e79-97f1-45a2-84b4-f37b5c0d8682
    type: derived
status: test
description: This rule flags process creation events where regini.exe is executed with a command line containing an ADS-style stream marker (a colon not followed by space or backslash). Using alternate data streams with regini.exe can be leveraged to tamper with registry values for persistence or defense impairment. It relies on Windows process creation telemetry, specifically the executed image name/original filename and the command-line content pattern.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Regini/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regini_ads.yml
author: Eli Salem, Sander Wiebing, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2023-02-08
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \regini.exe
    - OriginalFileName: REGINI.EXE
  selection_re:
    CommandLine|re: :[^ \\]
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1