Regedit Importing Registry Key From Alternate Data Stream
Detects the use of 'regedit.exe' to import a registry file that originates from an Alternate Data Stream (ADS). This technique can be used by adversaries for persistence, defense evasion, or to modify system configurations by importing registry keys from hidden data streams.
Sigma
