T1218.010Stealth
Regsvr32
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
19 Sigma rules tagged T1218.010Regsvr32T1218.01019 general rules
- HTML Help HH.EXE Suspicious Child Processhightest
- Potential EmpireMonkey Activityhightest
- Potentially Suspicious Child Process Of Regsvr32hightest
- Potentially Suspicious Regsvr32 HTTP IP Patternhightest
- Regsvr32 DLL Execution With Suspicious File Extensionhightest
- Regsvr32 Execution From Highly Suspicious Locationhightest
- Suspicious HH.EXE Executionhightest
- Suspicious Microsoft Office Child Processhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Regsvr32
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.