CmdID

CmdID / Techniques / T1218

T1218.009 System Binary Proxy Execution: Regsvcs/Regasm

Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. MITRE ATT&CK

2 programs on CmdID 3 Sigma rules T1218.009 on attack.mitre.org

Part of

MITRE ATT&CK
T1218System Binary Proxy Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
regasm.exeAWL Bypassregsvcs.exeExecute

Sigma rules tagged with it

process creation, the highest levels first
mediumPotentially Suspicious Execution Of Regasm/Regsvcs From Uncommon LocationNasreddine Bencherchali (Nextron Systems) · Windows
mediumPotentially Suspicious Execution Of Regasm/Regsvcs With Uncommon ExtensionNasreddine Bencherchali (Nextron Systems) · Windows
lowRegAsm.EXE Execution Without CommandLine Flags or Filesfrack113 · Windows