Sigma rule: Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly

Rule

Title

Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly

Status

test

Level

medium

Author

Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)

Date

2023-10-17

File

rules-threat-hunting/windows/process_creation/proc_creation_win_regsvr32_dllregisterserver_exec.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location.
When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.

Log source

product

windows

category

process_creation

Detection

selection_image:
    - Image|endswith: '\regsvr32.exe'
    - OriginalFileName: 'REGSVR32.EXE'
selection_cmdline:
    CommandLine|contains:
        - ' /s '
        - ' /e '
filter_main_paths:
    - CommandLine|contains:
          - ':\Program Files (x86)'
          - ':\Program Files\'
          - ':\Windows\System32\'
          - ':\Windows\SysWOW64\'
    - CurrentDirectory|contains:
          - ':\Program Files (x86)'
          - ':\Program Files\'
          - ':\Windows\System32\'
          - ':\Windows\SysWOW64\'
filter_main_other_flags:
    # Note: We filter other flags to keep the logic of the rule
    CommandLine|contains:
        - ' /i:'
        - '/U '
filter_main_rpcproxy:
    ParentCommandLine|endswith: ':\Windows\System32\RpcProxy\RpcProxy.dll'
    CommandLine: 'regsvr32 /s rpcproxy.dll'
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate usage as part of application installation, but less likely from e.g. temporary paths.

Tags

• attack.stealth
• attack.t1218
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1218

Related rules

• 0ba1da6d-b6ce-4366-828c-18826c9de23e (similar)

References

• https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
• https://www.virustotal.com/gui/file/288fc4f954f98d724e6fab32a89477943df5c0e9662cb199a19b90ae0c63aebe/detection
• https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver
• https://ss64.com/nt/regsvr32.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_regsvr32_dllregisterserver_exec.yml