Windows Process Creation: regsvr32 Silent OCX Execution from AppData Roaming

title: "Windows Process Creation: regsvr32 Silent OCX Execution from AppData Roaming"
id: 5094b28c-8c8c-478c-9842-0afdbb24788c
status: test
description: This rule matches Windows process creation events where the command line includes regsvr32 with /s /i and targets an .ocx file located under \\AppData\\Roaming\\. Using regsvr32 to load a remotely staged or dropped control file can help attackers execute code via signed binaries and reduce user visibility. The detection relies on process command-line telemetry that contains the specific regsvr32 parameters and path pattern.
references:
  - https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
  - https://app.any.run/tasks/33d37fdf-158d-4930-aa68-813e1d5eb8ba/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Evilnum/proc_creation_win_apt_evilnum_jul20.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-10
modified: 2023-03-09
tags:
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - regsvr32
      - /s
      - /i
      - \AppData\Roaming\
      - .ocx
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 8acf3cfa-1e8c-4099-83de-a0c4038e18f0
    type: derived