Regsvr32 Execution From Potential Suspicious Location

Rule Info

Name
Regsvr32 Execution From Potential Suspicious Location
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Description
Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.
Reference
https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html
Date
2023-05-26 00:00:00
Modified
None
Id
9525dc73-0327-438c-8c04-13c0e037e9da
Tags
attack.defense_evasion attack.t1218.010 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=9525dc73-0327-438c-8c04-13c0e037e9da

Rule History

Author
Title
Date
Commit
github-actions[bot]
Merge PR #4791 from @nasbench - Promote older rules status from `experimental` to `test`
2024-04-01
a8e1ecd65
Nasreddine Bencherchali
feat: apply suggestions from code review
2023-05-30
bcc0c9a9e
Nasreddine Bencherchali
fix: fp found in testing
2023-05-26
574c63ea0
Nasreddine Bencherchali
fix: issue to pass the tests
2023-05-26
00751c4c6
Nasreddine Bencherchali
feat: update more regsvr32
2023-05-26
547b8ffa7
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022