Windows Process Creation: Suspicious Child Processes Spawned by regsvr32.exe

Alerts when regsvr32.exe spawns suspicious child processes like PowerShell, mshta, or scripting utilities.

FreeUnreviewedSigmahighv1

windows-process-creation-suspicious-child-processes-spawned-by-regsvr32-exe-6f0947a4

title: "Windows Process Creation: Suspicious Child Processes Spawned by regsvr32.exe"
id: 3baf4508-dca1-43c0-89b3-3a40c9aea588
related:
  - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d
    type: obsolete
  - id: 6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca
    type: derived
status: test
description: This rule flags process creation events where the parent process is regsvr32.exe and the child process image matches a set of common interactive or scripting tools. Such behavior matters because regsvr32.exe can be abused to load and execute code via child processes, blending execution into normal-looking Windows activity. The detection relies on Windows process creation telemetry, specifically parent image and child image (with an exclusion for werfault.exe launched with a particular command-line pattern).
references:
  - https://redcanary.com/blog/intelligence-insights-april-2022/
  - https://www.echotrail.io/insights/search/regsvr32.exe
  - https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml
author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-05-05
modified: 2023-05-26
tags:
  - attack.stealth
  - attack.t1218.010
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \regsvr32.exe
    Image|endswith:
      - \calc.exe
      - \cscript.exe
      - \explorer.exe
      - \mshta.exe
      - \net.exe
      - \net1.exe
      - \nltest.exe
      - \notepad.exe
      - \powershell.exe
      - \pwsh.exe
      - \reg.exe
      - \schtasks.exe
      - \werfault.exe
      - \wscript.exe
  filter_main_werfault:
    Image|endswith: \werfault.exe
    CommandLine|contains: " -u -p "
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely, but can rarely occur. Apply additional filters accordingly.
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where the parent process is regsvr32.exe and the child process image matches a set of common interactive or scripting tools. Such behavior matters because regsvr32.exe can be abused to load and execute code via child processes, blending execution into normal-looking Windows activity. The detection relies on Windows process creation telemetry, specifically parent image and child image (with an exclusion for werfault.exe launched with a particular command-line pattern).

Known false positives

Unlikely, but can rarely occur. Apply additional filters accordingly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.