Detection rules › Sigma
Potentially Suspicious Regsvr32 HTTP IP Pattern
Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1218.010 System Binary Proxy Execution: Regsvr32 |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: Potentially Suspicious Regsvr32 HTTP IP Pattern
id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8
status: test
description: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.
references:
- https://twitter.com/mrd0x/status/1461041276514623491
- https://twitter.com/tccontre18/status/1480950986650832903
- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
author: Florian Roth (Nextron Systems)
date: 2022-01-11
modified: 2023-05-24
tags:
- attack.stealth
- attack.t1218.010
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\regsvr32.exe'
- OriginalFileName: 'REGSVR32.EXE'
selection_ip:
CommandLine|contains:
- ' /i:http://1'
- ' /i:http://2'
- ' /i:http://3'
- ' /i:http://4'
- ' /i:http://5'
- ' /i:http://6'
- ' /i:http://7'
- ' /i:http://8'
- ' /i:http://9'
- ' /i:https://1'
- ' /i:https://2'
- ' /i:https://3'
- ' /i:https://4'
- ' /i:https://5'
- ' /i:https://6'
- ' /i:https://7'
- ' /i:https://8'
- ' /i:https://9'
- ' -i:http://1'
- ' -i:http://2'
- ' -i:http://3'
- ' -i:http://4'
- ' -i:http://5'
- ' -i:http://6'
- ' -i:http://7'
- ' -i:http://8'
- ' -i:http://9'
- ' -i:https://1'
- ' -i:https://2'
- ' -i:https://3'
- ' -i:https://4'
- ' -i:https://5'
- ' -i:https://6'
- ' -i:https://7'
- ' -i:https://8'
- ' -i:https://9'
condition: all of selection_*
falsepositives:
- FQDNs that start with a number such as "7-Zip"
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith: '\regsvr32.exe'
- OriginalFileName: 'REGSVR32.EXE'
Stage 2: selection_ip
selection_ip:
CommandLine|contains:
- ' /i:http://1'
- ' /i:http://2'
- ' /i:http://3'
- ' /i:http://4'
- ' /i:http://5'
- ' /i:http://6'
- ' /i:http://7'
- ' /i:http://8'
- ' /i:http://9'
- ' /i:https://1'
- ' /i:https://2'
- ' /i:https://3'
- ' /i:https://4'
- ' /i:https://5'
- ' /i:https://6'
- ' /i:https://7'
- ' /i:https://8'
- ' /i:https://9'
- ' -i:http://1'
- ' -i:http://2'
- ' -i:http://3'
- ' -i:http://4'
- ' -i:http://5'
- ' -i:http://6'
- ' -i:http://7'
- ' -i:http://8'
- ' -i:http://9'
- ' -i:https://1'
- ' -i:https://2'
- ' -i:https://3'
- ' -i:https://4'
- ' -i:https://5'
- ' -i:https://6'
- ' -i:https://7'
- ' -i:https://8'
- ' -i:https://9'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|