{"id":"T1218.009","name":"Regsvcs/Regasm","url":"https://attack.mitre.org/techniques/T1218/009","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0361","stix_id":"x-mitre-detection-strategy--9c03f003-b859-42c6-b16d-c0979dfc202b","name":"Detecting .NET COM Registration Abuse via Regsvcs/Regasm","url":"https://attack.mitre.org/detectionstrategies/DET0361","analytics":[{"id":"AN1028","stix_id":"x-mitre-analytic--a5e9fb06-ab75-415d-beff-206aa059e096","name":"Analytic 1028","description":"Abuse of Regsvcs.exe or Regasm.exe to execute arbitrary code embedded in .NET assemblies via [ComRegisterFunction]/[ComUnregisterFunction]. Behavioral chain: (1) Process creation of regsvcs/regasm with suspicious assembly paths/flags → (2) Assembly/DLL load inside regsvcs/regasm → (3) Registry writes to HKCR\\CLSID/ProgID during COM registration → (4) Optional child process or network activity spawned by installer/registration code.","url":"https://attack.mitre.org/detectionstrategies/DET0361#AN1028","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=12","data_component":"DC0056","data_component_name":"Windows Registry Key Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AssemblyPathRegex","description":"Environment-specific paths to flag (e.g., %TEMP%, Downloads, OneDrive, SMB shares). Helps suppress known-good installers."},{"field":"SuspiciousFlags","description":"Arguments like /unregister (/u), /codebase, /regfile which may indicate abuse. Tune per enterprise use of regasm/regsvcs."},{"field":"ParentProcessAllowList","description":"Legitimate parents (e.g., setup.exe, msiexec.exe). Analyst can prune false positives from Office or script hosts."},{"field":"KnownGoodAssemblies","description":"Hashes or publisher info for approved assemblies commonly registered in the environment."},{"field":"RegistryKeyAllowList","description":"Approved CLSIDs/ProgIDs written during sanctioned software installs."},{"field":"TimeWindow","description":"Correlation window (e.g., 5–10 min) between file drop → regasm/regsvcs exec → registry writes → child activity."},{"field":"SignedToUnsignedTransition","description":"Alert if Microsoft-signed regasm/regsvcs loads or triggers unsigned assemblies/children."}],"live":true,"detection_strategies":["DET0361"],"techniques":["T1218.009"]}],"live":true,"version":"1.0","techniques":["T1218.009"]}],"sigma_rules":[{"id":"0531e43a-d77d-47c2-b89f-5fe50321c805","title":"RegAsm.EXE Initiating Network Connection To Public IP","author":"frack113","status":"test","level":"medium","date":"2024-04-25","modified":null,"description":"Detects \"RegAsm.exe\" initiating a network connection to public IP adresses","references":["https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/","https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/","https://lolbas-project.github.io/lolbas/Binaries/Regasm/"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.stealth","attack.t1218.009"],"path":"rules/windows/network_connection/net_connection_win_regasm_network_activity.yml","techniques":["T1218.009"],"cves":[]},{"id":"651f87f7-12db-47f9-84c5-f27b081b94b6","title":"RegAsm.EXE Execution Without CommandLine Flags or Files","author":"frack113","status":"experimental","level":"low","date":"2025-06-04","modified":null,"description":"Detects the execution of \"RegAsm.exe\" without a commandline flag or file, which might indicate potential process injection activity.\nUsually \"RegAsm.exe\" should point to a dedicated DLL file or call the help with the \"/?\" flag.\n","references":["https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/","https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla","https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool","https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2","https://www.joesandbox.com/analysis/1467354/0/html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.009"],"path":"rules/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml","techniques":["T1218.009"],"cves":[]},{"id":"cc368ed0-2411-45dc-a222-510ace303cb2","title":"Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-25","modified":"2023-02-13","description":"Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location","references":["https://www.fortiguard.com/threat-signal-report/4718?s=09","https://lolbas-project.github.io/lolbas/Binaries/Regasm/","https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.009"],"path":"rules/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_location_execution.yml","techniques":["T1218.009"],"cves":[]},{"id":"e9f8f8cc-07cc-4e81-b724-f387db9175e4","title":"Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-13","modified":null,"description":"Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.","references":["https://www.fortiguard.com/threat-signal-report/4718?s=09","https://lolbas-project.github.io/lolbas/Binaries/Regasm/","https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218.009"],"path":"rules/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_extension_execution.yml","techniques":["T1218.009"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}