Potentially Suspicious Child Process Of Regsvr32

calendar Aug 12, 2024 · attack.defense-evasion attack.t1218.010  ·
Share on: linkedin copy

Detects potentially suspicious child processes of "regsvr32.exe".

Sigma rule (View on GitHub)

 1title: Potentially Suspicious Child Process Of Regsvr32
 2id: 6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca
 3related:
 4    - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d
 5      type: obsolete
 6status: test
 7description: Detects potentially suspicious child processes of "regsvr32.exe".
 8references:
 9    - https://redcanary.com/blog/intelligence-insights-april-2022/
10    - https://www.echotrail.io/insights/search/regsvr32.exe
11    - https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo
12author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
13date: 2022-05-05
14modified: 2023-05-26
15tags:
16    - attack.defense-evasion
17    - attack.t1218.010
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection:
23        ParentImage|endswith: '\regsvr32.exe'
24        Image|endswith:
25            - '\calc.exe'
26            - '\cscript.exe'
27            - '\explorer.exe'
28            - '\mshta.exe'
29            - '\net.exe'
30            - '\net1.exe'
31            - '\nltest.exe'
32            - '\notepad.exe'
33            - '\powershell.exe'
34            - '\pwsh.exe'
35            - '\reg.exe'
36            - '\schtasks.exe'
37            - '\werfault.exe'
38            - '\wscript.exe'
39    filter_main_werfault:
40        Image|endswith: '\werfault.exe'
41        CommandLine|contains: ' -u -p '
42    condition: selection and not 1 of filter_main_*
43falsepositives:
44    - Unlikely, but can rarely occur. Apply additional filters accordingly.
45level: high

References

Related rules

to-top