T1218.009Stealth
Regsvcs/Regasm
Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register.NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. Both utilities may be used to bypass application control through use of attributes within the binary to…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
4 Sigma rules tagged T1218.009Regsvcs/RegasmT1218.0094 general rules
- Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Locationmediumtest
- Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extensionmediumtest
- RegAsm.EXE Initiating Network Connection To Public IPmediumtest
- RegAsm.EXE Execution Without CommandLine Flags or Fileslowexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Regsvcs/Regasm
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.