Cross-source coverage
T1121 / ATT&CK
Regsvcs/Regasm
ATT&CK has retired this technique. Rules still tag it; the current id is T1218.009 System Binary Proxy Execution: Regsvcs/Regasm.
1 rule across 1 source.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Regsvcs and Regasm are Windows command-line utilities that are used to register.NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft.
Adversaries can use Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Both utilities may be used to bypass process whitelisting through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.
- Platforms
- Windows
- Telemetry
- —
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| possible_applocker_bypass | Undefined | YARA-L |