Execution of regsvcs/regasm with uncommon paths

BIOC Informational

Execution of regsvcs/regasm with uncommon paths

The regasm.exe/regsvcs.exe commands are used to register .NET COM assemblies, which are typically located in specific paths. Uncommon paths may indicate malicious code is being registered.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Execution
Status:: Enabled

ATT&CK tactics: Defense Evasion (TA0005)

ATT&CK techniques: System Binary Proxy Execution: Regsvcs/Regasm (T1218.009)

Indicator:

Process action type = execution AND target process name = regasm.exe , regsvcs.exe AND target process cmd = *appdata\*dll* , *programdata\*dll* , *temp\*dll* , *tmp\*dll* , *documents\*dll , *$recycle.bin\*dll* AND target process cmd != *program files*

Preventable: yes