
title: Regsvr32 Network Activity
author: Dmitriy Lifanov, oscd.community
date: 2019/10/25
description: Detects network connections and DNS queries initiated by Regsvr32.exe
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    Image: '*\regsvr32.exe'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- unknown
fields:
- ComputerName
- User
- Image
- DestinationIp
- DestinationPort
id: c7e91a02-d771-4a6d-a700-42587e0b1095
level: high
logsource:
  category: network_connection
  product: windows
modified: 2021/09/21
references:
- https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
- https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/T1117.md
status: experimental
tags:
- attack.execution
- attack.t1559.001
- attack.t1175
- attack.defense_evasion
- attack.t1218.010
- attack.t1117
ruletype: SIGMA
