.. /Reg.exe
Star

Used to manipulate the registry


Paths:

Resources:
Acknowledgements:

Detection:

Alternate data streams

Export the target Registry key and save it to the specified .REG file within an Alternate data stream.
reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg
Usecase: Hide/plant registry information in Alternate data stream for later use
Privileges required: User
OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1564.004



Credentials

Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material
reg save HKLM\SECURITY c:\test\security.bak && reg save HKLM\SYSTEM c:\test\system.bak && reg save HKLM\SAM c:\test\sam.bak
Usecase: Dump credentials from the Security Account Manager (SAM)
Privileges required: Administrator
OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1003.002