attack.t1218.010 | Detection.FYI

DNS Query Request By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·
Share on:

Detects DNS queries initiated by "Regsvr32.exe"

Read More
HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Read More
Network Connection Initiated By Regsvr32.EXE

Aug 12, 2024 · attack.execution attack.t1559.001 attack.defense-evasion attack.t1218.010 ·
Share on:

Detects a network connection initiated by "Regsvr32.exe"

Read More
Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 detection.emerging-threats ·
Share on:

Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local

Read More
Potential EmpireMonkey Activity

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 detection.emerging-threats ·
Share on:

Detects potential EmpireMonkey APT activity

Read More
Potential Regsvr32 Commandline Flag Anomaly

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

Read More
Potentially Suspicious Child Process Of Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects potentially suspicious child processes of "regsvr32.exe".

Read More
Potentially Suspicious Regsvr32 HTTP IP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

Read More
Potentially Suspicious Regsvr32 HTTP/FTP Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.

Read More
Regsvr32 DLL Execution With Suspicious File Extension

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects the execution of REGSVR32.exe with DLL files masquerading as other files

Read More
Regsvr32 Execution From Highly Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects execution of regsvr32 where the DLL is located in a highly suspicious locations

Read More
Regsvr32 Execution From Potential Suspicious Location

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.

Read More
Scripting/CommandLine Process Spawned Regsvr32

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.

Read More
Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·
Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Read More
Suspicious Microsoft Office Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Read More
Suspicious Regsvr32 Execution From Remote Share

Aug 12, 2024 · attack.defense-evasion attack.t1218.010 ·
Share on:

Detects REGSVR32.exe to execute DLL hosted on remote shares

Read More
Suspicious WMIC Execution Via Office Process

Aug 12, 2024 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense-evasion ·
Share on:

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Read More
Suspicious WmiPrvSE Child Process

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·
Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

Read More
Unsigned DLL Loaded by Windows Utility

Aug 12, 2024 · attack.t1218.011 attack.t1218.010 attack.defense-evasion ·
Share on:

Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.

Read More
File Creation by Office Applications

Apr 21, 2023 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense_evasion ·
Share on:

This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.

Read More