RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)

title: RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)
id: a9e4185d-d902-42c7-8092-00faf8f6c5d2
status: experimental
description: This rule flags executions of RegAsm.exe where the process command line does not include an expected invocation pattern or target file. An attacker may misuse RegAsm.exe to run unexpected .NET-related functionality without supplying typical arguments, which can support stealthy execution. The detection relies on Windows process creation telemetry, matching the process image name (ends with \RegAsm.exe or OriginalFileName) and the command-line ending patterns.
references:
  - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/
  - https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla
  - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
  - https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2
  - https://www.joesandbox.com/analysis/1467354/0/html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml
author: frack113, Huntrule Team
date: 2025-06-04
tags:
  - attack.stealth
  - attack.t1218.009
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \RegAsm.exe
    - OriginalFileName: RegAsm.exe
  selection_cli:
    CommandLine|endswith:
      - RegAsm
      - RegAsm.exe
      - RegAsm.exe"
      - RegAsm.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate use of Regasm by developers.
level: low
license: DRL-1.1
related:
  - id: 651f87f7-12db-47f9-84c5-f27b081b94b6
    type: derived