.. /Regedit.exe
Star

Used by Windows to manipulate registry


Paths:

Resources:
Acknowledgements:

Detection:

Alternate data streams

Export the target Registry key to the specified .REG file.
regedit /E c:\ads\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
Usecase: Hide registry data in alternate data stream
Privileges required: User
OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1564.004



Import the target .REG file into the Registry.
regedit C:\ads\file.txt:regfile.reg
Usecase: Import hidden registry data from alternate data stream
Privileges required: User
OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1564.004