Execution via Regsvcs/Regasm

 1[metadata]
 2creation_date = "2020/03/25"
 3deprecation_date = "2021/03/17"
 4maturity = "deprecated"
 5updated_date = "2021/03/17"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10RegSvcs.exe and RegAsm.exe are Windows command line utilities that are used to register .NET Component Object Model
11(COM) assemblies. Adversaries can use RegSvcs.exe and RegAsm.exe to proxy execution of code through a trusted Windows
12utility.
13"""
14from = "now-9m"
15index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
16language = "kuery"
17license = "Elastic License v2"
18name = "Execution via Regsvcs/Regasm"
19risk_score = 21
20rule_id = "47f09343-8d1f-4bb5-8bb0-00c9d18f5010"
21severity = "low"
22tags = ["Elastic", "Host", "Windows", "Threat Detection", "Execution"]
23timestamp_override = "event.ingested"
24type = "query"
25
26query = '''
27event.category:process and event.type:(start or process_started) and process.name:(RegAsm.exe or RegSvcs.exe)
28'''
29
30
31[[rule.threat]]
32framework = "MITRE ATT&CK"
33
34[rule.threat.tactic]
35id = "TA0002"
36name = "Execution"
37reference = "https://attack.mitre.org/tactics/TA0002/"
38[[rule.threat]]
39framework = "MITRE ATT&CK"
40[[rule.threat.technique]]
41id = "T1218"
42name = "Signed Binary Proxy Execution"
43reference = "https://attack.mitre.org/techniques/T1218/"
44[[rule.threat.technique.subtechnique]]
45id = "T1218.009"
46name = "Regsvcs/Regasm"
47reference = "https://attack.mitre.org/techniques/T1218/009/"
48
49
50
51[rule.threat.tactic]
52id = "TA0005"
53name = "Defense Evasion"
54reference = "https://attack.mitre.org/tactics/TA0005/"