.. /Reg.exe

Star

Used to manipulate the registry

• https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
• https://pure.security/dumping-windows-credentials/

Alternate data streams

1. Export the target Registry key and save it to the specified .REG file within an Alternate data stream.

   reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg

   Use case

   Hide/plant registry information in Alternate data stream for later use

   Privileges required

   User

   Operating systems

   Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   ATT&CK® technique

   T1564.004

Credentials

1. Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material

   reg save HKLM\SECURITY c:\test\security.bak && reg save HKLM\SYSTEM c:\test\system.bak && reg save HKLM\SAM c:\test\sam.bak

   Use case

   Dump credentials from the Security Account Manager (SAM)

   Privileges required

   Administrator

   Operating systems

   Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   ATT&CK® technique

   T1003.002