Detectionhightest

Potentially Suspicious Regsvr32 HTTP IP Pattern

Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Tue Jan 11Updated Wed May 242dd2c217-bf68-437a-b57c-fe9fd01d5de8windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\regsvr32.exe'
        - OriginalFileName: 'REGSVR32.EXE'
    selection_ip:
        CommandLine|contains:
            - ' /i:http://1'
            - ' /i:http://2'
            - ' /i:http://3'
            - ' /i:http://4'
            - ' /i:http://5'
            - ' /i:http://6'
            - ' /i:http://7'
            - ' /i:http://8'
            - ' /i:http://9'
            - ' /i:https://1'
            - ' /i:https://2'
            - ' /i:https://3'
            - ' /i:https://4'
            - ' /i:https://5'
            - ' /i:https://6'
            - ' /i:https://7'
            - ' /i:https://8'
            - ' /i:https://9'
            - ' -i:http://1'
            - ' -i:http://2'
            - ' -i:http://3'
            - ' -i:http://4'
            - ' -i:http://5'
            - ' -i:http://6'
            - ' -i:http://7'
            - ' -i:http://8'
            - ' -i:http://9'
            - ' -i:https://1'
            - ' -i:https://2'
            - ' -i:https://3'
            - ' -i:https://4'
            - ' -i:https://5'
            - ' -i:https://6'
            - ' -i:https://7'
            - ' -i:https://8'
            - ' -i:https://9'
    condition: all of selection_*