--- Name: reg.exe Description: Export Reg, Add ADS, Import Reg Author: '' Created: '2018-05-25' Categories: [] Commands: - Command: reg export HKLM\SOFTWARE\Microsoft\Evilreg c:\ads\file.txt:evilreg.reg Description: Export the target Registry key and save it to the specified .REG file. Full Path: - c:\windows\system32\reg.exe - c:\windows\sysWOW64\reg.exe Code Sample: [] Detection: [] Resources: - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f Notes: Thanks to Oddvar Moe - @oddvarmoe