
title: Regsvr32 Command Line Without DLL
author: Florian Roth
date: 2019/07/17
description: Detects a regsvr.exe execution that doesn't contain a DLL in the command
  line
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\regsvr32.exe'
  SELECTION_3:
    CommandLine:
    - '*.dll*'
    - '*.ocx*'
    - '*.cpl*'
    - '*.ax*'
    - '*.bav*'
    - '*.ppl*'
  SELECTION_4:
    CommandLine|re: ^$
  SELECTION_5:
    CommandLine: ''
  condition: (SELECTION_1 and ((SELECTION_2 and  not (SELECTION_3)) and  not (SELECTION_4))
    and  not (SELECTION_5))
falsepositives:
- Unknown
fields:
- CommandLine
- ParentCommandLine
id: 50919691-7302-437f-8e10-1fe088afa145
level: high
logsource:
  category: process_creation
  product: windows
modified: 2021/10/19
references:
- https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
status: experimental
tags:
- attack.defense_evasion
- attack.t1574
- attack.execution
ruletype: SIGMA
