Used by Windows to manipulate registry
regedit /E c:\ads\file.txt:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey
Export the target Registry key to the specified .REG file.
Hide registry data in alternate data stream
C:\Windows\regedit.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml, IOC: regedit.exe reading and writing to alternate data stream, IOC: regedit.exe should normally not be executed by end-users
Oddvar Moe (@oddvarmoe)