Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter

title: Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter
id: 4d3d95e9-ef4a-42d1-b563-dd9ebf1ef928
status: test
description: This rule flags regsvr32.exe process executions where the command line includes an /i:http://X or /i:https://X pattern with a numeric IP component (e.g., /i:http://1 through /i:http://9). Attackers commonly use regsvr32 to load or install DLLs from remote locations, allowing execution with minimal user interaction. The detection relies on Windows process creation telemetry, matching regsvr32 image/filename and specific HTTP/HTTPS IP address patterns in the command line.
references:
  - https://twitter.com/mrd0x/status/1461041276514623491
  - https://twitter.com/tccontre18/status/1480950986650832903
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2023-05-24
tags:
  - attack.stealth
  - attack.t1218.010
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \regsvr32.exe
    - OriginalFileName: REGSVR32.EXE
  selection_ip:
    CommandLine|contains:
      - " /i:http://1"
      - " /i:http://2"
      - " /i:http://3"
      - " /i:http://4"
      - " /i:http://5"
      - " /i:http://6"
      - " /i:http://7"
      - " /i:http://8"
      - " /i:http://9"
      - " /i:https://1"
      - " /i:https://2"
      - " /i:https://3"
      - " /i:https://4"
      - " /i:https://5"
      - " /i:https://6"
      - " /i:https://7"
      - " /i:https://8"
      - " /i:https://9"
      - " -i:http://1"
      - " -i:http://2"
      - " -i:http://3"
      - " -i:http://4"
      - " -i:http://5"
      - " -i:http://6"
      - " -i:http://7"
      - " -i:http://8"
      - " -i:http://9"
      - " -i:https://1"
      - " -i:https://2"
      - " -i:https://3"
      - " -i:https://4"
      - " -i:https://5"
      - " -i:https://6"
      - " -i:https://7"
      - " -i:https://8"
      - " -i:https://9"
  condition: all of selection_*
falsepositives:
  - FQDNs that start with a number such as "7-Zip"
level: high
license: DRL-1.1
related:
  - id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8
    type: derived