Suspicious Registry Modification From ADS Via Regini.EXE

Title: Suspicious Registry Modification From ADS Via Regini.EXE
Status: test
Description:Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Regini/
  -https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini
Author: Eli Salem, Sander Wiebing, oscd.community
Date: 2020-10-12
modified:2023-02-08
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\regini.exe' OriginalFileName:'REGINI.EXE'   selection_re:
    CommandLine|re: ':[^ \\]'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high