Used to manipulate the registry
regini.exe newfile.txt:hidden.ini
Write registry keys from data inside the Alternate data stream.
Write to registry
C:\Windows\System32\regini.exe, C:\Windows\SysWOW64\regini.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_ads.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_regini_execution.yml, IOC: regini.exe reading from ADS
Eli Salem (@elisalem9)