Windows Regsvr32.exe Initiated Network Connection

title: Windows Regsvr32.exe Initiated Network Connection
id: 5895235f-bc4b-47a6-9b2c-9ee50acbfcd4
status: test
description: This rule flags network connections where the Initiated flag is true and the originating process image ends with \regsvr32.exe. Attackers can abuse Regsvr32.exe to trigger outbound communication while blending in with a legitimate Windows binary, potentially enabling staging, downloading, or command and control. It relies on Windows network connection telemetry that includes a process image path and an Initiated indicator.
references:
  - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_regsvr32_network_activity.yml
author: Dmitriy Lifanov, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2023-09-18
tags:
  - attack.execution
  - attack.stealth
  - attack.t1559.001
  - attack.t1218.010
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith: \regsvr32.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c7e91a02-d771-4a6d-a700-42587e0b1095
    type: derived