Cross-source coverage
T1218.010 / ATT&CK
System Binary Proxy Execution: Regsvr32
69 rules · 67 families across 6 sources.
1 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.
Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmon
How MITRE says to detect it DET0282
Detection Strategy for System Binary Proxy Execution: Regsvr32
Windows Analytic 0785
Detection focuses on identifying anomalous regsvr32.exe executions that deviate from normal administrative or system use. Defenders may observe regsvr32.exe loading scriptlets or DLLs from unusual paths (especially temporary directories or remote URLs), command-line arguments invoking /i or /u with suspicious file references, network connections initiated by regsvr32.exe, and unsigned or untrusted DLLs being loaded shortly after regsvr32.exe invocation. Correlated sequences include regsvr32.exe process creation, module load of DLL/scriptlet, and optional outbound network traffic.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=3, 22
elastic/protections-artifacts
20 rules| Detection | Severity | Format |
|---|---|---|
| BCDEdit Safe Mode Command Execution | Undefined | Elastic TOML |
| Execution of Commonly Abused Utilities via Explorer Trampoline | Undefined | Elastic TOML |
| Execution via a Suspicious WMI Client | Undefined | Elastic TOML |
| Execution via Outlook Application COM Object | Undefined | Elastic TOML |
| ImageLoad of a File dropped via SMB | Undefined | Elastic TOML |
| Inhibit System Recovery via Signed Binary Proxy | Undefined | Elastic TOML |
| Regsvr32 Scriptlet Execution | Undefined | Elastic TOML |
| Regsvr32 with Unusual Arguments | Undefined | Elastic TOML |
| Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory | Undefined | Elastic TOML |
| RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS | Undefined | Elastic TOML |
+ 10 more from elastic/protections-artifacts → showing the 10 highest-severity
SigmaHQ/sigma
19 rules| Detection | Severity | Format |
|---|---|---|
| HTML Help HH.EXE Suspicious Child Process | High | Sigma |
| Potential EmpireMonkey Activity | High | Sigma |
| Potentially Suspicious Child Process Of Regsvr32 | High | Sigma |
| Potentially Suspicious Regsvr32 HTTP IP Pattern | High | Sigma |
| Regsvr32 DLL Execution With Suspicious File Extension | High | Sigma |
| Regsvr32 Execution From Highly Suspicious Location | High | Sigma |
| Suspicious HH.EXE Execution | High | Sigma |
| Suspicious Microsoft Office Child Process | High | Sigma |
| Suspicious Regsvr32 Execution From Remote Share | High | Sigma |
| Suspicious WMIC Execution Via Office Process | High | Sigma |
+ 9 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
17 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious Managed Code Hosting Process | High | Elastic TOML |
| Suspicious Windows Command Shell Arguments | High | Elastic TOML |
| Execution from Unusual Directory - Command Line | Medium | Elastic TOML |
| Execution of Persistent Suspicious Program | Medium | Elastic TOML |
| Potential Command and Control via Internet Explorer | Medium | Elastic TOML |
| Suspicious Execution from a Mounted Device | Medium | Elastic TOML |
| Suspicious Explorer Child Process | Medium | Elastic TOML |
| Suspicious JetBrains TeamCity Child Process | Medium | Elastic TOML |
| Suspicious MS Office Child Process | Medium | Elastic TOML |
| Suspicious .NET Code Compilation | Medium | Elastic TOML |
+ 7 more from elastic/detection-rules → showing the 10 highest-severity
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Detect Regsvr32 Application Control Bypass | Undefined | SPL |
| Malicious InProcServer32 Modification | Undefined | SPL |
| Regsvr32 Silent and Install Param Dll Loading | Undefined | SPL |
| Suspicious Regsvr32 Register Suspicious Path | Undefined | SPL |
| Windows IOBit Unlocker Extension DLL Registration via Regsvr32 | Undefined | SPL |
| Windows Regsvr32 Renamed Binary | Undefined | SPL |
Bert-JanP/Hunting-Queries-Detection-Rules
4 rules · 3 families| Detection | Severity | Format |
|---|---|---|
| Detect when Regsvr32.exe is created as subprocess by an Office Application | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| URL Lookup (Network & Commandline) 2 variants | Undefined | KQL |
| URL Lookup (Network & Commandline) 2 variants | Undefined | KQL |
Azure/Azure-Sentinel
3 rules| Detection | Severity | Format |
|---|---|---|
| regsvr32-rundll32-abnormal-image-loads | Undefined | KQL |
| regsvr32-rundll32-image-loads-abnormal-extension | Undefined | KQL |
| regsvr32-rundll32-with-anomalous-parent-process | Undefined | KQL |