Regedit Export to Alternate Data Stream
This rule detects when 'regedit.exe' is used to export a registry key to an Alternate Data Stream (ADS). This technique can be used by adversaries to hide data, such as exported registry keys, within existing files to evade detection. The rule specifically looks for the execution of 'regedit.exe' which is a legitimate Windows utility, making the detection focused on its suspicious usage in conjunction with ADS.
Sigma
