detection.wiki

Detection rules › Sigma

RegAsm.EXE Execution Without CommandLine Flags or Files

Status
experimental
Severity
low
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity. Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.

MITRE ATT&CK coverage

TacticTechniques
StealthT1218.009 System Binary Proxy Execution: Regsvcs/Regasm

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: RegAsm.EXE Execution Without CommandLine Flags or Files
id: 651f87f7-12db-47f9-84c5-f27b081b94b6
status: experimental
description: |
    Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity.
    Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.
references:
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/
    - https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla
    - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
    - https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2
    - https://www.joesandbox.com/analysis/1467354/0/html
author: frack113
date: 2025-06-04
tags:
    - attack.stealth
    - attack.t1218.009
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\RegAsm.exe'
        - OriginalFileName: 'RegAsm.exe'
    selection_cli:
        CommandLine|endswith:
            - 'RegAsm'
            - 'RegAsm.exe'
            - 'RegAsm.exe"'
            - "RegAsm.exe'"
    condition: all of selection_*
falsepositives:
    - Legitimate use of Regasm by developers.
# Note: You can increase after an initial baseline
level: low

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\RegAsm.exe'
    - OriginalFileName: 'RegAsm.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|endswith:
        - 'RegAsm'
        - 'RegAsm.exe'
        - 'RegAsm.exe"'
        - "RegAsm.exe'"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • RegAsm
  • RegAsm.exe
  • RegAsm.exe"
  • RegAsm.exe'
Imageends_with
  • \RegAsm.exe corpus 9 (sigma 9)
OriginalFileNameeq
  • RegAsm.exe corpus 8 (sigma 6, elastic 1, splunk 1)