Windows RegAsm.exe Initiating Network Connections to Public IPs

title: Windows RegAsm.exe Initiating Network Connections to Public IPs
id: f2e80941-870d-4a7d-a03c-4fd5e2d7b315
status: test
description: This rule flags instances where RegAsm.exe starts an outbound network connection to a destination IP that is not within common local/private or loopback ranges. Attackers may use RegAsm.exe to blend in with legitimate Windows binaries while reaching external infrastructure. It relies on network connection telemetry that records whether the connection was initiated and the source image path along with the destination IP.
references:
  - https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/
  - https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/
  - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_regasm_network_activity.yml
author: frack113, Huntrule Team
date: 2024-04-25
tags:
  - attack.stealth
  - attack.t1218.009
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith: \regasm.exe
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0531e43a-d77d-47c2-b89f-5fe50321c805
    type: derived