Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter

Alerts when regsvr32 is invoked with an /i: HTTP/HTTPS IP pattern to fetch remote DLLs.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-01-11
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.010Regsvr32
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags regsvr32.exe process executions where the command line includes an /i:http://X or /i:https://X pattern with a numeric IP component (e.g., /i:http://1 through /i:http://9). Attackers commonly use regsvr32 to load or install DLLs from remote locations, allowing execution with minimal user interaction. The detection relies on Windows process creation telemetry, matching regsvr32 image/filename and specific HTTP/HTTPS IP address patterns in the command line.

Reporting behind it

Related detections9 linkedT1218.010 — drag to rearrange

Malicious DLL Registration via regsvr32 Loading prnfldr (via process_creation)

Suspicious Regsvr32 Execution of SafePay Loader DLL

Suspicious Scheduled Task Running Regsvr32 with Extreme Duration by StaryDobry

Malicious DynamicWrapperX Registration via regsvr32 (via process_creation)

Suspicious Run Key Persistence Executing regsvr32

Suspicious regsvr32 Registering DLL from User AppData

Malicious Regsvr32 Loading Masqueraded VPN DLL via Process Creation

Malicious Regsvr32 ShellExec_RunDLL Proxy Execution (via process_creation)

Suspicious DLL Execution via Regsvr32 DllInstall of dat File

Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter

Pivot detection · T1218.010 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-regsvr32-downloads-remote-dlls-via-http-https-ip-in-i-parameter-2dd2c217

title: Windows regsvr32 Downloads Remote DLLs via HTTP/HTTPS IP in /i Parameter
id: 4d3d95e9-ef4a-42d1-b563-dd9ebf1ef928
status: test
description: This rule flags regsvr32.exe process executions where the command line includes an /i:http://X or /i:https://X pattern with a numeric IP component (e.g., /i:http://1 through /i:http://9). Attackers commonly use regsvr32 to load or install DLLs from remote locations, allowing execution with minimal user interaction. The detection relies on Windows process creation telemetry, matching regsvr32 image/filename and specific HTTP/HTTPS IP address patterns in the command line.
references:
  - https://twitter.com/mrd0x/status/1461041276514623491
  - https://twitter.com/tccontre18/status/1480950986650832903
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2023-05-24
tags:
  - attack.stealth
  - attack.t1218.010
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \regsvr32.exe
    - OriginalFileName: REGSVR32.EXE
  selection_ip:
    CommandLine|contains:
      - " /i:http://1"
      - " /i:http://2"
      - " /i:http://3"
      - " /i:http://4"
      - " /i:http://5"
      - " /i:http://6"
      - " /i:http://7"
      - " /i:http://8"
      - " /i:http://9"
      - " /i:https://1"
      - " /i:https://2"
      - " /i:https://3"
      - " /i:https://4"
      - " /i:https://5"
      - " /i:https://6"
      - " /i:https://7"
      - " /i:https://8"
      - " /i:https://9"
      - " -i:http://1"
      - " -i:http://2"
      - " -i:http://3"
      - " -i:http://4"
      - " -i:http://5"
      - " -i:http://6"
      - " -i:http://7"
      - " -i:http://8"
      - " -i:http://9"
      - " -i:https://1"
      - " -i:https://2"
      - " -i:https://3"
      - " -i:https://4"
      - " -i:https://5"
      - " -i:https://6"
      - " -i:https://7"
      - " -i:https://8"
      - " -i:https://9"
  condition: all of selection_*
falsepositives:
  - FQDNs that start with a number such as "7-Zip"
level: high
license: DRL-1.1
related:
  - id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL