LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Regini.exe

View source

Used to manipulate the registry

ADS
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

ADS1

EXAMPLE 01T1564.004

Write registry keys from data inside the Alternate data stream.

COMMAND
regini.exe {PATH}:hidden.ini
USE CASE
Write to registry
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\regini.exe
C:\Windows\SysWOW64\regini.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    regini.exe reading from ADS

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Eli Salem@elisalem9