Sigma rule: Regsvr32 Anomaly

Rule

Title

Regsvr32 Anomaly

Status

deprecated

Level

high

Author

Florian Roth (Nextron Systems), oscd.community, Tim Shelton

Date

2019/01/16

Modified

2023/05/26

File

deprecated/windows/proc_creation_win_regsvr32_anomalies.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects various anomalies in relation to regsvr32.exe

Log source

product

windows

category

process_creation

Detection

selection1:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains: '\Temp\'
selection2:
    Image|endswith: '\regsvr32.exe'
    ParentImage|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\powershell_ise.exe'
selection3:
    Image|endswith: '\regsvr32.exe'
    ParentImage|endswith: '\cmd.exe'
selection4a:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains|all:
        - '/i:'
        - 'http'
    CommandLine|endswith: 'scrobj.dll'
selection4b:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains|all:
        - '/i:'
        - 'ftp'
    CommandLine|endswith: 'scrobj.dll'
selection5:
    Image|endswith:
        - '\cscript.exe'
        - '\wscript.exe'
    ParentImage|endswith: '\regsvr32.exe'
selection6:
    Image|endswith: '\EXCEL.EXE'
    CommandLine|contains: '..\..\..\Windows\System32\regsvr32.exe '
selection7:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith: '\regsvr32.exe'
selection8:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains:
        - '\AppData\Local'
        - 'C:\Users\Public'
selection9: # suspicious extensions https://twitter.com/Max_Mal_/status/1542461200797163522/photo/3
    Image|endswith: '\regsvr32.exe'
    CommandLine|endswith:
        - '.jpg'
        - '.jpeg'
        - '.png'
        - '.gif'
        - '.bin'
        - '.tmp'
        - '.temp'
        - '.txt'
filter1:
    CommandLine|contains:
        - '\AppData\Local\Microsoft\Teams'
        - '\AppData\Local\WebEx\WebEx64\Meetings\atucfobj.dll'
filter2:
    ParentImage: 'C:\Program Files\Box\Box\FS\streem.exe'
    CommandLine|contains: '\Program Files\Box\Box\Temp\'
filter_legitimate:
    CommandLine|endswith: '/s C:\Windows\System32\RpcProxy\RpcProxy.dll'
condition: 1 of selection* and not 1 of filter*

False positives (as the rule lists them)

• Unknown

Tags

• attack.defense_evasion
• attack.t1218.010
• car.2019-04-002
• car.2019-04-003

MITRE ATT&CK ids this rule names

• T1218.010

References

• https://subt0x10.blogspot.de/2017/04/bypass-application-whitelisting-script.html
• https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/proc_creation_win_regsvr32_anomalies.yml