Scripting/CommandLine Process Spawned Regsvr32

Rule Info

Name
Scripting/CommandLine Process Spawned Regsvr32
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Description
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.
Date
2023-05-26 00:00:00
Modified
None
Id
ab37a6ec-6068-432b-a64e-2c7bf95b1d22
Tags
attack.defense_evasion attack.t1218.010 DEMO
Type
Community Rule

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
feat: apply suggestions from code review
2023-05-30
Nasreddine Bencherchali
fix: issue to pass the tests
2023-05-26
Nasreddine Bencherchali
feat: update more regsvr32
2023-05-26