Imports Registry Key From an ADS — Detection Rule

Detects the import of a alternate datastream to the registry with regedit.exe.

Read the full analysis on IntelFusions