RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)
Alert on RegAsm.exe process creation when the command line lacks typical Regasm flags or file parameters.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2025-06-04
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions of RegAsm.exe where the process command line does not include an expected invocation pattern or target file. An attacker may misuse RegAsm.exe to run unexpected .NET-related functionality without supplying typical arguments, which can support stealthy execution. The detection relies on Windows process creation telemetry, matching the process image name (ends with \RegAsm.exe or OriginalFileName) and the command-line ending patterns.
Reporting behind it
- mcafee.comhttps://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/
- zscaler.frhttps://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
- app.any.runhttps://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2
- joesandbox.comhttps://www.joesandbox.com/analysis/1467354/0/html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)
id: a9e4185d-d902-42c7-8092-00faf8f6c5d2
status: experimental
description: This rule flags executions of RegAsm.exe where the process command line does not include an expected invocation pattern or target file. An attacker may misuse RegAsm.exe to run unexpected .NET-related functionality without supplying typical arguments, which can support stealthy execution. The detection relies on Windows process creation telemetry, matching the process image name (ends with \RegAsm.exe or OriginalFileName) and the command-line ending patterns.
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/
- https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla
- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
- https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2
- https://www.joesandbox.com/analysis/1467354/0/html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml
author: frack113, Huntrule Team
date: 2025-06-04
tags:
- attack.stealth
- attack.t1218.009
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \RegAsm.exe
- OriginalFileName: RegAsm.exe
selection_cli:
CommandLine|endswith:
- RegAsm
- RegAsm.exe
- RegAsm.exe"
- RegAsm.exe'
condition: all of selection_*
falsepositives:
- Legitimate use of Regasm by developers.
level: low
license: DRL-1.1
related:
- id: 651f87f7-12db-47f9-84c5-f27b081b94b6
type: derived