Emotet: Regsvr32 Execution from Microsoft Excel (RedCanary Threat Detection Report)

calendar May 17, 2023 · attack.s0367  ·
Share on: linkedin copy

Detects Regsvr32 execution from Excel, a technique associated with Emotet. Part of the RedCanary 2023 Threat Detection Report.

Sigma rule (View on GitHub)

 1title: 'Emotet: Regsvr32 Execution from Microsoft Excel (RedCanary Threat Detection Report)'
 2id: 2cbe546e-8c8a-41ab-80d4-aadd2961b3c7
 3status: experimental
 4description: Detects Regsvr32 execution from Excel, a technique associated with Emotet. Part of the RedCanary 2023 Threat Detection Report.
 5references:
 6    - https://redcanary.com/threat-detection-report/threats/emotet/
 7author: RedCanary, Sigma formatting by Micah Babinski
 8date: 2023/05/10
 9tags:
10    - attack.s0367
11logsource:
12    category: process_creation
13    product: windows
14detection:
15    selection:
16        ParentImage|endswith: '\excel.exe'
17        Image|endswith: '\regsvr32.exe'
18    condition: selection
19falsepositives:
20    - Unknown
21level: low```

References

to-top