regsvr32 Referencing Unusual Paths (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may abuse regsvr32.exe to proxy execution of malicious code. regsvr32 is a command-line program used to register and unregister object linking and embedding controls including .dlls. This use case detects executions of regsvr32 involving frequently abused file paths as observed with the DarkWatchMan remote access trojan. Applications with normal use from AppData\Local should be whitelisted using the full file path. LOLBAS/LOLBINS

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.010` System Binary Proxy Execution: Regsvr32

References

https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: '21595.38143'
title: regsvr32 Referencing Unusual Paths
description: Adversaries may abuse regsvr32.exe to proxy execution of malicious code.
  regsvr32 is a command-line program used to register and unregister object linking
  and embedding controls including .dlls. This use case detects executions of regsvr32
  involving frequently abused file paths as observed with the DarkWatchMan remote
  access trojan. Applications with normal use from AppData\Local should be whitelisted
  using the full file path. LOLBAS/LOLBINS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(regsvr32) ("\\Temp\\" OR "\\AppData\\Local"
  OR "\\Users\\Public") | where (match(process, "(?i)\x5c(Temp|Appdata\x5cLocal|Users\x5cPublic)")
  and match(process_name, "(?i)regsvr32\.exe")) | table _time, host, user, signature_id,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:regsvr32
technique_id:
- T1218.010
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://www.virustotal.com/gui/file/d439a3ce7353ef96cf3556abba1e5da77eac21fdba09d6a4aad42d1fc88c1e3c/behavior

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) TERM(regsvr32) ("\\Temp\\" OR "\\AppData\\Local" OR "\\Users\\Public")

Stage 2: `where`

| where (match(process, "(?i)\x5c(Temp|Appdata\x5cLocal|Users\x5cPublic)") and match(process_name, "(?i)regsvr32\.exe"))

Stage 3: `table`

| table _time, host, user, signature_id, process, process_*, parent_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`process`	regex_match	`"(?i)\x5c(Temp\|Appdata\x5cLocal\|Users\x5cPublic)"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`
`process_name`	regex_match	`"(?i)regsvr32.exe"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4688<"`
1	`regsvr32`
1	`"\\Temp\\"`
1	`"\\AppData\\Local"`
1	`"\\Users\\Public"`