Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter
Alerts when regsvr32 is invoked with an /i: HTTP/HTTPS IP pattern to fetch remote DLLs.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-11
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags regsvr32.exe process executions where the command line includes an /i:http://X or /i:https://X pattern with a numeric IP component (e.g., /i:http://1 through /i:http://9). Attackers commonly use regsvr32 to load or install DLLs from remote locations, allowing execution with minimal user interaction. The detection relies on Windows process creation telemetry, matching regsvr32 image/filename and specific HTTP/HTTPS IP address patterns in the command line.
Reporting behind it
- twitter.comhttps://twitter.com/mrd0x/status/1461041276514623491
- twitter.comhttps://twitter.com/tccontre18/status/1480950986650832903
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter
id: 4d3d95e9-ef4a-42d1-b563-dd9ebf1ef928
status: test
description: This rule flags regsvr32.exe process executions where the command line includes an /i:http://X or /i:https://X pattern with a numeric IP component (e.g., /i:http://1 through /i:http://9). Attackers commonly use regsvr32 to load or install DLLs from remote locations, allowing execution with minimal user interaction. The detection relies on Windows process creation telemetry, matching regsvr32 image/filename and specific HTTP/HTTPS IP address patterns in the command line.
references:
- https://twitter.com/mrd0x/status/1461041276514623491
- https://twitter.com/tccontre18/status/1480950986650832903
- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2023-05-24
tags:
- attack.stealth
- attack.t1218.010
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \regsvr32.exe
- OriginalFileName: REGSVR32.EXE
selection_ip:
CommandLine|contains:
- " /i:http://1"
- " /i:http://2"
- " /i:http://3"
- " /i:http://4"
- " /i:http://5"
- " /i:http://6"
- " /i:http://7"
- " /i:http://8"
- " /i:http://9"
- " /i:https://1"
- " /i:https://2"
- " /i:https://3"
- " /i:https://4"
- " /i:https://5"
- " /i:https://6"
- " /i:https://7"
- " /i:https://8"
- " /i:https://9"
- " -i:http://1"
- " -i:http://2"
- " -i:http://3"
- " -i:http://4"
- " -i:http://5"
- " -i:http://6"
- " -i:http://7"
- " -i:http://8"
- " -i:http://9"
- " -i:https://1"
- " -i:https://2"
- " -i:https://3"
- " -i:https://4"
- " -i:https://5"
- " -i:https://6"
- " -i:https://7"
- " -i:https://8"
- " -i:https://9"
condition: all of selection_*
falsepositives:
- FQDNs that start with a number such as "7-Zip"
level: high
license: DRL-1.1
related:
- id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8
type: derived