Windows regsvr32.exe DNS queries detected

title: Windows regsvr32.exe DNS queries detected
id: 0faac4bb-e366-434a-b4b1-dd9a73a372d7
related:
  - id: c7e91a02-d771-4a6d-a700-42587e0b1095
    type: derived
  - id: 36e037c4-c228-4866-b6a3-48eb292b9955
    type: derived
status: test
description: This rule identifies DNS query events where the process image path ends with \regsvr32.exe. Regsvr32.exe is a signed Windows binary that attackers may misuse to execute code, where DNS lookups can indicate outbound communication or staging. The detection relies on Windows DNS query telemetry that includes the querying process image.
references:
  - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_regsvr32_dns_query.yml
author: Dmitriy Lifanov, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2023-09-18
tags:
  - attack.execution
  - attack.stealth
  - attack.t1559.001
  - attack.t1218.010
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    Image|endswith: \regsvr32.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1