Exports Registry Key To an Alternate Data Stream

Title: Exports Registry Key To an Alternate Data Stream
Status: test
Description:Exports the target Registry key and hides it in the specified alternate data stream.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  -https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Author: Oddvar Moe, Sander Wiebing, oscd.community
Date: 2020-10-07
modified:2021-11-27
Tags:

• -'attack.stealth'
• -'attack.t1564.004'

Logsource:

• product: windows
• category: create_stream_hash

Detection:
  selection:
    Image|endswith: '\regedit.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high