
title: Regsvr32 Anomaly
author: Florian Roth, oscd.community
date: 2019/01/16
description: Detects various anomalies in relation to regsvr32.exe
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_10:
    CommandLine:
    - '*http*'
    - '*ftp*'
  SELECTION_11:
    CommandLine: '*scrobj.dll'
  SELECTION_12:
    Image: '*\wscript.exe'
  SELECTION_13:
    ParentImage: '*\regsvr32.exe'
  SELECTION_14:
    Image: '*\EXCEL.EXE'
  SELECTION_15:
    CommandLine: '*..\..\..\Windows\System32\regsvr32.exe *'
  SELECTION_16:
    ParentImage: '*\mshta.exe'
  SELECTION_17:
    Image: '*\regsvr32.exe'
  SELECTION_18:
    Image: '*\regsvr32.exe'
  SELECTION_19:
    CommandLine:
    - '*\AppData\Local*'
    - '*C:\Users\Public*'
  SELECTION_2:
    Image: '*\regsvr32.exe'
  SELECTION_3:
    CommandLine: '*\Temp\\*'
  SELECTION_4:
    Image: '*\regsvr32.exe'
  SELECTION_5:
    ParentImage: '*\powershell.exe'
  SELECTION_6:
    Image: '*\regsvr32.exe'
  SELECTION_7:
    ParentImage: '*\cmd.exe'
  SELECTION_8:
    Image: '*\regsvr32.exe'
  SELECTION_9:
    CommandLine: '*/i:*'
  condition: (SELECTION_1 and ((SELECTION_2 and SELECTION_3) or (SELECTION_4 and SELECTION_5)
    or (SELECTION_6 and SELECTION_7) or (SELECTION_8 and SELECTION_9 and SELECTION_10
    and SELECTION_11) or (SELECTION_12 and SELECTION_13) or (SELECTION_14 and SELECTION_15)
    or (SELECTION_16 and SELECTION_17) or (SELECTION_18 and SELECTION_19)))
falsepositives:
- Unknown
fields:
- CommandLine
- ParentCommandLine
id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d
level: high
logsource:
  category: process_creation
  product: windows
modified: 2021/07/18
references:
- https://subt0x10.blogspot.de/2017/04/bypass-application-whitelisting-script.html
- https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
status: experimental
tags:
- attack.defense_evasion
- attack.t1218.010
- attack.execution
- attack.t1117
- car.2019-04-002
- car.2019-04-003
ruletype: SIGMA
