Detectionlowexperimental

RegAsm.EXE Execution Without CommandLine Flags or Files

Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity. Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Wed Jun 04651f87f7-12db-47f9-84c5-f27b081b94b6windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\RegAsm.exe'
        - OriginalFileName: 'RegAsm.exe'
    selection_cli:
        CommandLine|endswith:
            - 'RegAsm'
            - 'RegAsm.exe'
            - 'RegAsm.exe"'
            - "RegAsm.exe'"
    condition: all of selection_*