Windows regsvr32 Executes DLL with Uncommon Extension in Command Line

Alerts when regsvr32.exe is launched with a DLL extension pattern that is not in the common list.

FreeUnreviewedSigmamediumv1

windows-regsvr32-executes-dll-with-uncommon-extension-in-command-line-50919691

title: Windows regsvr32 Executes DLL with Uncommon Extension in Command Line
id: 0375ae0c-13f3-4b33-bd95-ef9fc3701b71
status: test
description: This rule flags process creation events where regsvr32.exe is invoked but the command line does not include common DLL-related extensions such as .ax, .cpl, .dll (including .dll.mui), or .ocx. Attackers may use regsvr32 with less typical extensions to reduce detection and blend execution into normal system tooling. It relies on Windows process creation telemetry, matching the regsvr32 binary and filtering command-line content.
references:
  - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-07-17
modified: 2023-05-24
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.stealth
  - attack.t1574
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \regsvr32.exe
    - OriginalFileName: REGSVR32.EXE
  filter_main_legit_ext:
    CommandLine|contains:
      - .ax
      - .cpl
      - .dll
      - .ocx
  filter_optional_pascal:
    CommandLine|contains: .ppl
  filter_optional_avg:
    CommandLine|contains: .bav
  filter_main_null_4688:
    CommandLine: null
  filter_main_empty_4688:
    CommandLine: ""
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Other legitimate extensions currently not in the list either from third party or specific Windows components.
level: medium
license: DRL-1.1
related:
  - id: 50919691-7302-437f-8e10-1fe088afa145
    type: derived

What it detects

This rule flags process creation events where regsvr32.exe is invoked but the command line does not include common DLL-related extensions such as .ax, .cpl, .dll (including .dll.mui), or .ocx. Attackers may use regsvr32 with less typical extensions to reduce detection and blend execution into normal system tooling. It relies on Windows process creation telemetry, matching the regsvr32 binary and filtering command-line content.

Known false positives

Other legitimate extensions currently not in the list either from third party or specific Windows components.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.