Suspicious Registry Modification From ADS Via Regini.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects the use of 'regini.exe' to modify registry keys by importing an alternate data stream. This technique can be used for persistence, defense evasion, or other malicious activities by adversaries.