CmdID / Techniques / T1218

T1218.010 System Binary Proxy Execution: Regsvr32

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. MITRE ATT&CK

4 programs on CmdID 16 Sigma rules T1218.010 on attack.mitre.org

Part of

MITRE ATT&CK

T1218System Binary Proxy Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

hh.exeits Sigma rules reg.exeits Sigma rules regsvr32.exeAWL Bypass wmic.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows

highPotential EmpireMonkey ActivityMarkus Neis, Nasreddine Bencherchali (Nextron Systems) · Windows

highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highPotentially Suspicious Regsvr32 HTTP IP PatternFlorian Roth (Nextron Systems) · Windows

highRegsvr32 DLL Execution With Suspicious File ExtensionFlorian Roth (Nextron Systems), frack113 · Windows

highRegsvr32 Execution From Highly Suspicious LocationNasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · Windows

highSuspicious Regsvr32 Execution From Remote ShareNasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious WMIC Execution Via Office ProcessVadim Khrykov, Cyb3rEng · Windows

highSuspicious WmiPrvSE Child ProcessVadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) · Windows

mediumPotential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumPotential Regsvr32 Commandline Flag AnomalyFlorian Roth (Nextron Systems) · Windows

mediumPotentially Suspicious Regsvr32 HTTP/FTP PatternFlorian Roth (Nextron Systems) · Windows

mediumRegsvr32 Execution From Potential Suspicious LocationFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

mediumScripting/CommandLine Process Spawned Regsvr32Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows