Cross-source coverage
T1121 / ATT&CK
Regsvcs/Regasm
ATT&CK has retired this technique. Rules still tag it; the current id is T1218.009 System Binary Proxy Execution: Regsvcs/Regasm.
0 rules across 0 sources.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Regsvcs and Regasm are Windows command-line utilities that are used to register.NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft.
Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.
- Platforms
- Windows
- Telemetry
- —
No live rules cover this technique. 1 deprecated rule is hidden.