Threat Huntmediumtest

Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly

Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location. When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)Created Tue Oct 17ce2c44b5-a6ac-412a-afba-9e89326fa972windows

Hunting Hypothesis

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_image:
        - Image|endswith: '\regsvr32.exe'
        - OriginalFileName: 'REGSVR32.EXE'
    selection_cmdline:
        CommandLine|contains:
            - ' /s '
            - ' /e '
    filter_main_paths:
        - CommandLine|contains:
              - ':\Program Files (x86)'
              - ':\Program Files\'
              - ':\Windows\System32\'
              - ':\Windows\SysWOW64\'
        - CurrentDirectory|contains:
              - ':\Program Files (x86)'
              - ':\Program Files\'
              - ':\Windows\System32\'
              - ':\Windows\SysWOW64\'
    filter_main_other_flags:
        # Note: We filter other flags to keep the logic of the rule
        CommandLine|contains:
            - ' /i:'
            - '/U '
    filter_main_rpcproxy:
        ParentCommandLine|endswith: ':\Windows\System32\RpcProxy\RpcProxy.dll'
        CommandLine: 'regsvr32 /s rpcproxy.dll'
    condition: all of selection_* and not 1 of filter_main_*