Scripting/CommandLine Process Spawned Regsvr32

Rule Info

Name
Scripting/CommandLine Process Spawned Regsvr32
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Description
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.
Reference
https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html
Date
2023-05-26 00:00:00
Modified
None
Id
ab37a6ec-6068-432b-a64e-2c7bf95b1d22
Tags
attack.defense-evasion attack.t1218.010
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=ab37a6ec-6068-432b-a64e-2c7bf95b1d22

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
github-actions[bot]
Merge PR #4791 from @nasbench - Promote older rules status from `experimental` to `test`
2024-04-01
a8e1ecd65
Nasreddine Bencherchali
feat: apply suggestions from code review
2023-05-30
bcc0c9a9e
Nasreddine Bencherchali
fix: issue to pass the tests
2023-05-26
00751c4c6
Nasreddine Bencherchali
feat: update more regsvr32
2023-05-26
547b8ffa7
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022