Lolbin Unregmp2.exe Use As Proxy

 1title: Lolbin Unregmp2.exe Use As Proxy
 2id: 727454c0-d851-48b0-8b89-385611ab0704
 3status: test
 4description: Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"
 5references:
 6    - https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/
 7author: frack113
 8date: 2022/12/29
 9tags:
10    - attack.defense_evasion
11    - attack.t1218
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection_img:
17        - Image|endswith: '\unregmp2.exe'
18        - OriginalFileName: 'unregmp2.exe'
19    selection_cmd:
20        CommandLine|contains: ' /HideWMP'
21    condition: all of selection_*
22falsepositives:
23    - Unknown
24level: medium

References

• Unregmp2 | LOLBAS

  Allows an attacker to copy a target binary to a controlled directory and modify the 'ProgramW6432' environment variable to point to that controlled directory, then execute 'unregmp2.exe' with argum...

  
  Read More

Related rules

• AgentExecutor PowerShell Execution
• Lolbin Runexehelper Use As Proxy
• Potential DLL Sideloading Using Coregen.exe
• Suspicious AgentExecutor PowerShell Execution
• Potentially Suspicious Child Process Of VsCode