Cross-source coverage
T1218.009 / ATT&CK
System Binary Proxy Execution: Regsvcs/Regasm
21 rules across 4 sources.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register.NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft.
Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:PowerShell
How MITRE says to detect it DET0361
Detecting .NET COM Registration Abuse via Regsvcs/Regasm
Windows Analytic 1028
Abuse of Regsvcs.exe or Regasm.exe to execute arbitrary code embedded in.NET assemblies via [ComRegisterFunction]/[ComUnregisterFunction]. Behavioral chain: (1) Process creation of regsvcs/regasm with suspicious assembly paths/flags → (2) Assembly/DLL load inside regsvcs/regasm → (3) Registry writes to HKCR\CLSID/ProgID during COM registration → (4) Optional child process or network activity spawned by installer/registration code.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=12WinEventLog:SysmonEventCode=13, 14WinEventLog:SysmonEventCode=11WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106WinEventLog:SysmonEventCode=3, 22
elastic/detection-rules
7 rules| Detection | Severity | Format |
|---|---|---|
| Execution from Unusual Directory - Command Line | Medium | Elastic TOML |
| Execution of Persistent Suspicious Program | Medium | Elastic TOML |
| Suspicious MS Office Child Process | Medium | Elastic TOML |
| Delayed Execution via Ping | Low | Elastic TOML |
| Network Connection via Registration Utility | Low | Elastic TOML |
| Suspicious MS Outlook Child Process | Low | Elastic TOML |
| Suspicious PDF Reader Child Process | Low | Elastic TOML |
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Detect Regasm Spawning a Process | Undefined | SPL |
| Detect Regasm with Network Connection | Undefined | SPL |
| Detect Regasm with no Command Line Arguments | Undefined | SPL |
| Detect Regsvcs Spawning a Process | Undefined | SPL |
| Detect Regsvcs with Network Connection | Undefined | SPL |
| Detect Regsvcs with No Command Line Arguments | Undefined | SPL |
SigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location | Medium | Sigma |
| Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension | Medium | Sigma |
| RegAsm.EXE Initiating Network Connection To Public IP | Medium | Sigma |
| RegAsm.EXE Execution Without CommandLine Flags or Files | Low | Sigma |
elastic/protections-artifacts
4 rules| Detection | Severity | Format |
|---|---|---|
| Execution via a Suspicious WMI Client | Undefined | Elastic TOML |
| Inhibit System Recovery via Signed Binary Proxy | Undefined | Elastic TOML |
| Suspicious Registry Modification via WMI | Undefined | Elastic TOML |
| Suspicious Windows Schedule Child Process | Undefined | Elastic TOML |