Techniques › T1218.010 › AN0785
AN0785 Analytic 0785
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection focuses on identifying anomalous regsvr32.exe executions that deviate from normal administrative or system use. Defenders may observe regsvr32.exe loading scriptlets or DLLs from unusual paths (especially temporary directories or remote URLs), command-line arguments invoking /i or /u with suspicious file references, network connections initiated by regsvr32.exe, and unsigned or untrusted DLLs being loaded shortly after regsvr32.exe invocation. Correlated sequences include regsvr32.exe process creation, module load of DLL/scriptlet, and optional outbound network traffic.</p>
- Detects
- T1218.010 Regsvr32
- Part of
- DET0282 Detection Strategy for System Binary Proxy Execution: Regsvr32
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedDLLPaths | Directories where DLL loading via regsvr32.exe is expected (e.g., C:\Windows\System32). |
ScriptletExtensions | File extensions considered suspicious when executed by regsvr32.exe (e.g., .sct, .ocx). |
TimeWindow | Timeframe to correlate regsvr32.exe process creation with subsequent module loads and network connections. |
ParentProcessWhitelist | Parent processes from which regsvr32.exe is expected (e.g., explorer.exe during legitimate COM object registration). |