LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Regedit.exe

View source

Used by Windows to manipulate registry

ADS
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

ADS2

EXAMPLE 01T1564.004

Export the target Registry key to the specified .REG file.

COMMAND
regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
USE CASE
Hide registry data in alternate data stream
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
EXAMPLE 02T1564.004

Import the target .REG file into the Registry.

COMMAND
regedit {PATH_ABSOLUTE}:regfile.reg
USE CASE
Import hidden registry data from alternate data stream
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\regedit.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    regedit.exe reading and writing to alternate data stream

  • IOC

    regedit.exe should normally not be executed by end-users

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe