Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

RegAsm.EXE Initiating Network Connection To Public IP

Detects "RegAsm.exe" initiating a network connection to public IP adresses

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Thu Apr 250531e43a-d77d-47c2-b89f-5fe50321c805windows
Log Source
WindowsNetwork Connection
ProductWindows← raw: windows
CategoryNetwork Connection← raw: network_connection

Events for outbound and inbound network connections including DNS resolution.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        Initiated: 'true'
        Image|endswith: '\regasm.exe'
    filter_main_local_ranges:
        DestinationIp|cidr:
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '::1/128'  # IPv6 loopback
            - 'fe80::/10'  # IPv6 link-local addresses
            - 'fc00::/7'  # IPv6 private addresses
    condition: selection and not 1 of filter_main_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
app.any.run
2
Resolving title…
research.splunk.com
3
Resolving title…
lolbas-project.github.io
MITRE ATT&CK
Rule Metadata
Rule ID
0531e43a-d77d-47c2-b89f-5fe50321c805
Status
test
Level
medium
Type
Detection
Created
Thu Apr 25
Author
François Hubaut
Path
rules/windows/network_connection/net_connection_win_regasm_network_activity.yml
Raw Tags
attack.defense-evasionattack.t1218.009
View on GitHub