Windows RegAsm.exe Initiates Network Connection to Public IP

Alerts on RegAsm.exe initiating outbound connections to public (non-local/private) IP addresses.

FreeReviewedSigma · Medium · v2

Product: windows
Category: network_connection
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2024-04-25
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.009Regsvcs/Regasm
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies RegAsm.exe processes that initiate an outbound network connection to IP addresses outside common local and private ranges. Attackers may use RegAsm as a signed, legitimate binary to blend into normal activity while reaching external infrastructure. It relies on network connection telemetry indicating process initiation and destination IP information to distinguish public from private/local destinations.

Reporting behind it

Related detections9 linkedT1218.009 — drag to rearrange

Suspicious Proxy Execution via RegAsm or RegSvcs (via process_creation)

Suspicious CloudZ RAT Loader Execution via regasm.exe LOLBin

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

Suspicious Outbound Connection From CasPol Binary

Suspicious Assembly Execution via Regasm or Regsvcs From a User Path (via process_creation)

Suspicious CasPol Execution Spawned by PowerShell for Injection

Suspicious PowerShell Spawning .NET LOLBIN (via process_creation)

RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)

Windows Suspicious Execution of Regasm/Regsvcs With Uncommon Command-Line Extension

Windows RegAsm.exe Initiates Network Connection to Public IP

Pivot detection · T1218.009 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-regasm-exe-initiating-network-connections-to-public-ips-0531e43a

title: Windows RegAsm.exe Initiates Network Connection to Public IP
id: f2e80941-870d-4a7d-a03c-4fd5e2d7b315
status: test
description: This rule identifies RegAsm.exe processes that initiate an outbound network connection to IP addresses outside common local and private ranges. Attackers may use RegAsm as a signed, legitimate binary to blend into normal activity while reaching external infrastructure. It relies on network connection telemetry indicating process initiation and destination IP information to distinguish public from private/local destinations.
references:
  - https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/
  - https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/
  - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_regasm_network_activity.yml
author: frack113, Huntrule Team
date: 2024-04-25
tags:
  - attack.stealth
  - attack.t1218.009
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith: \regasm.exe
  filter_main_local_ranges:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 169.254.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0531e43a-d77d-47c2-b89f-5fe50321c805
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL