regedit.exe

Wine registry counterpart of the Microsoft Windows regedit service. tldr-pages

LOLBAS ADS 5 Sigma rules name it 2 ATT&CK techniques 2 documented commands 14 known copies with hashes

How regedit.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

-e

ADS T1564.004 Hide Artifacts: NTFS File Attributes

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for regedit.exe.

2 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Export the target Registry key to the specified .REG file.

regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey

Identify

Trips 1 Sigma rule: lowExports Registry Key To a File by Oddvar Moe, Sander Wiebing, oscd.community

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Import the target .REG file into the Registry.

regedit {PATH_ABSOLUTE}:regfile.reg

Identify

Trips 2 Sigma rules: highImports Registry Key From an ADS by Oddvar Moe, Sander Wiebing, oscd.community; mediumImports Registry Key From a File by Oddvar Moe, Sander Wiebing, oscd.community

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for regedit.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for regedit.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highRegedit as Trusted InstallerFlorian Roth (Nextron Systems)

highExports Critical Registry Keys To a FileOddvar Moe, Sander Wiebing, oscd.community

highImports Registry Key From an ADSOddvar Moe, Sander Wiebing, oscd.community

mediumImports Registry Key From a FileOddvar Moe, Sander Wiebing, oscd.community

lowExports Registry Key To a FileOddvar Moe, Sander Wiebing, oscd.community

T1548Abuse Elevation Control Mechanism

T1564.004Hide Artifacts: NTFS File Attributes

Is it the real regedit.exe?

file version info and known copies

Installed inC:\Windows\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionRegistry Editor

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\regedit.exe · signed by Microsoft Windows

18e9f0139965e4f349ca7482681738b55a79f136dfc3e9af488d31f22a87d78d

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regedit.exe · signed by Microsoft Windows

b53f00c3bf125ed2953b4d0936cd01e1bd1b01fb24e67c4a58e7e8d482bcde8e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regedit.exe · signed by Microsoft Windows

92e81342732cce1eefc16629b4587e8c4338ae6b180018cfb870e51c64bbc203

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\regedit.exe · signed by Microsoft Windows

92f24fed2ba2927173aad58981f6e0643c6b89815b117e8a7c4a0988ac918170

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\regedit.exe · signed by Microsoft Windows

f5cb9796e4517d2e2d3468a5de1da12bc57d0a582cab46f8a70b69b0ffde928d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regedit.exe · signed by Microsoft Windows

f6953923fa9537edd709488db8fc17c7991f4f053a904306d9b93d79391fb0e6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\regedit.exe · signed by Microsoft Windows

7acc4a0b686d829d4d4c8afbf9e38e562be5a6f708a1c2273358aa7e41e1cb97

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regedit.exe · signed by Microsoft Windows

d5de45decfd0fa08ac12f5725dfc7e5af1e3ed0325559101990fdcf02c439441

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regedit.exe · signed by Microsoft Windows

a9bfe5633ced879d8a94b66a06a294bc6d6ef466eaee46ae4d25cb0e3a1d79a5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\regedit.exe · signed by Microsoft Windows

ff3b56204f0cea172aefb178e05a32c3c3c0be93f29dd4c2df46a6de07bb5152

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\regedit.exe · signed by Microsoft Windows

1eda28d11bb4ec6de741b7a9323b1358d93f796791799f787ac5626116b4acbc

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\regedit.exe · signed by Microsoft Windows

254b18a8cc6589af666ee17ce4e76c67350aecf578206cc7678745ed47a32d63

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\regedit.exe · not signed

bbd0be7bd07c90aa690c6484b765d19a02bf5c60841d6497d8395bc5b1f976d2

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\regedit.exe · not signed

dce18e2279073ba64a6f35d17120fdca9a4902faef0c99cd96a5d673209e132f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Export a specific registry key and contents to a file

regedit -E path/to/file path/to/registry_keyIdentify

Trips 1 Sigma rule: lowExports Registry Key To a File by Oddvar Moe, Sander Wiebing, oscd.community

Delete a specified registry key

regedit -D path/to/registry_keyIdentify

Open the graphical registry manager

regeditIdentify

Of the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.