reg.exe

Performs operations on registry subkey information and values in registry entries. Windows commands reference

LOLBAS ADS, Credentials 54 Sigma rules name it 25 ATT&CK techniques 2 documented commands 12 known copies with hashes

How reg.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

export

Credentials T1003.002 OS Credential Dumping: Security Account Manager

save

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for reg.exe.

2 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Export the target Registry key and save it to the specified .REG file within an Alternate data stream.

reg export HKLM\SOFTWARE\Microsoft\Evilreg {PATH_ABSOLUTE}:evilreg.reg

Identify

Trips no Sigma process-creation rule.

Credentials T1003.002 OS Credential Dumping: Security Account Manager Administrator privileges

Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material

reg save HKLM\SECURITY {PATH_ABSOLUTE:.1.bak} && reg save HKLM\SYSTEM {PATH_ABSOLUTE:.2.bak} && reg save HKLM\SAM {PATH_ABSOLUTE:.3.bak}

Identify

Trips 1 Sigma rule: highDumping of Sensitive Hives Via Reg.EXE by Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113

1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for reg.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for reg.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highWindows AMSI Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highWindows EventLog Autologger Session Registry Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highWindows Credential Guard Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highSecurity Event Logging Disabled via MiniNt Registry Key - ProcessSwachchhanda Shrawan Poudel (Nextron Systems)

highHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highAdd SafeBoot Keys Via Reg UtilityNasreddine Bencherchali (Nextron Systems)

highRunMRU Registry Key DeletionSwachchhanda Shrawan Poudel (Nextron Systems)

highSafeBoot Registry Key Deleted Via Reg.EXENasreddine Bencherchali (Nextron Systems), Tim Shelton

highService Registry Key Deleted Via Reg.EXENasreddine Bencherchali (Nextron Systems)

highDisabling Windows Defender WMI Autologger Session via Reg.exeMatt Anderson (Huntress)

highDumping of Sensitive Hives Via Reg.EXETeymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113

highPotential Tampering With RDP Related Registry Keys Via Reg.EXEpH-T (Nextron Systems), @Kostastsale, TheDFIRReport

highReg Add Suspicious Pathsfrack113, Nasreddine Bencherchali (Nextron Systems)

highSystem Restore Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Windows Defender Registry Key Tampering Via Reg.EXEFlorian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)

highRegistry Export of Third-Party CredentialsSwachchhanda Shrawan Poudel (Nextron Systems)

highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highUser Shell Folders Registry Modification via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highVulnerable Driver Blocklist Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious WSL InstallLocation Registry Key Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

mediumPotential Persistence Attempt Via Run Keys Using Reg.EXEFlorian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

mediumSuspicious Windows Defender Folder Exclusion Added Via Reg.EXEfrack113

mediumPotentially Suspicious Desktop Background Change Using Reg.EXEStephen Lincoln @slincoln-aiq (AttackIQ)

mediumWindows Recall Feature Enabled Via Reg.EXESajid Nawaz Khan

mediumEnumeration for Credentials in Registryfrack113

mediumPotential Suspicious Registry File Imported Via Reg.EXEfrack113, Nasreddine Bencherchali

mediumRegistry Tampering Of Internal Tools SettingsSwachchhanda Shrawan Poudel (Nextron Systems)

mediumPotential Configuration And Service Reconnaissance Via Reg.EXETimur Zinniatullin, oscd.community

mediumSuspicious ScreenSave Change by Reg.exefrack113

mediumChanging Existing Service ImagePath Value Via Reg.EXEfrack113

And 24 more rules that name reg.exe.

T1003.002OS Credential Dumping: Security Account Manager

T1003.004OS Credential Dumping: LSA Secrets

T1003.005OS Credential Dumping: Cached Domain Credentials

T1007System Service Discovery

T1012Query Registry

T1021.001Remote Services: Remote Desktop Protocol

T1070.003Indicator Removal: Clear Command History

T1082System Information Discovery

T1112Modify Registry

T1113Screen Capture

T1218System Binary Proxy Execution

T1218.010System Binary Proxy Execution: Regsvr32

T1490Inhibit System Recovery

T1491.001Defacement: Internal Defacement

T1546.001Event Triggered Execution: Change Default File Association

T1546.002Event Triggered Execution: Screensaver

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

T1552.002Unsecured Credentials: Credentials in Registry

T1564.002Hide Artifacts: Hidden Users

T1564.004Hide Artifacts: NTFS File Attributes

T1574.011Hijack Execution Flow: Services Registry Permissions Weakness

T1614.001System Location Discovery: System Language Discovery

T1685Disable or Modify Tools

T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log

Is it the real reg.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionRegistry Console Tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\reg.exe · signed by Microsoft Windows

1b3853a8bceaad1329463d42b2151a39eef8e008d27a8e7f05783fa80e666994

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\reg.exe · signed by Microsoft Windows

73bfda07389c54c24805639a814009a4f295fed70b6a46b63f630ed7df564bb4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\reg.exe · signed by Microsoft Windows

224a746aee2957c3fca376f4457cfc044c1ec99e75756195b27cab396174e2db

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\reg.exe · signed by Microsoft Windows

c0e25b1f9b22de445298c1e96ddfcead265ca030fa6626f61a4a4786cc4a3b7d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\reg.exe · signed by Microsoft Windows

45eff48450c110b8a6d2a4c0fe31323423851298f6dadf32d73df91df7ecb797

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\reg.exe · signed by Microsoft Windows

4ed2a27860fa154415f65452ff1f94bd6af762982e2f3470030c504dc3c8a354

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\reg.exe · signed by Microsoft Windows

19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\reg.exe · signed by Microsoft Windows

e3046d83040d114af09c6b7738f69b14ec180ece999573489a7d3386e4ababb5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\reg.exe · signed by Microsoft Windows

9e28034ce3aeea6951f790f8997df44cfbf80beff9fb17413dba317016a716ad

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\reg.exe · signed by Microsoft Windows

cbb9f8d012cb0af2ca87ac74abb5c77a7743c64697c8d92104d3eba27a699ab0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\reg.exe · not signed

849f54dc526ea18d59abaf4904cb11bc15b982d2952b971f2e1b6fbf8c974b39

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\reg.exe · not signed

b0bea6e6254f069b22fe9b6af14a316587dfd4b6642134677de5901744f4a08e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Execute a registry command

reg commandIdentify

View documentation for adding and copying subkeys

tldr reg addIdentify

View documentation for deleting keys and subkeys

tldr reg deleteIdentify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.