Detectionmediumtest
Potential Regsvr32 Commandline Flag Anomaly
Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems)Created Sat Jul 13Updated Wed Mar 13b236190c-1c61-41e9-84b3-3fe03f6d76b0windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection:
Image|endswith: '\regsvr32.exe'
CommandLine|contains|windash: ' -i:'
filter_main_flag:
CommandLine|contains|windash: ' -n '
condition: selection and not 1 of filter_main_*False Positives
Administrator typo might cause some false positives
References
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
b236190c-1c61-41e9-84b3-3fe03f6d76b0
Status
test
Level
medium
Type
Detection
Created
Sat Jul 13
Modified
Wed Mar 13
Path
rules/windows/process_creation/proc_creation_win_regsvr32_flags_anomaly.yml
Raw Tags
attack.defense-evasionattack.t1218.010