Suspicious Registry Modification From ADS Via Regini.EXE — Detection Rule
Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.
Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.