Windows regsvr32 Executes DLL with Uncommon Extension in Command Line
Alerts when regsvr32.exe is launched with a DLL extension pattern that is not in the common list.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-07-17
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where regsvr32.exe is invoked but the command line does not include common DLL-related extensions such as .ax, .cpl, .dll (including .dll.mui), or .ocx. Attackers may use regsvr32 with less typical extensions to reduce detection and blend execution into normal system tooling. It relies on Windows process creation telemetry, matching the regsvr32 binary and filtering command-line content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows regsvr32 Executes DLL with Uncommon Extension in Command Line
id: 0375ae0c-13f3-4b33-bd95-ef9fc3701b71
status: test
description: This rule flags process creation events where regsvr32.exe is invoked but the command line does not include common DLL-related extensions such as .ax, .cpl, .dll (including .dll.mui), or .ocx. Attackers may use regsvr32 with less typical extensions to reduce detection and blend execution into normal system tooling. It relies on Windows process creation telemetry, matching the regsvr32 binary and filtering command-line content.
references:
- https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-07-17
modified: 2023-05-24
tags:
- attack.privilege-escalation
- attack.persistence
- attack.stealth
- attack.t1574
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \regsvr32.exe
- OriginalFileName: REGSVR32.EXE
filter_main_legit_ext:
CommandLine|contains:
- .ax
- .cpl
- .dll
- .ocx
filter_optional_pascal:
CommandLine|contains: .ppl
filter_optional_avg:
CommandLine|contains: .bav
filter_main_null_4688:
CommandLine: null
filter_main_empty_4688:
CommandLine: ""
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Other legitimate extensions currently not in the list either from third party or specific Windows components.
level: medium
license: DRL-1.1
related:
- id: 50919691-7302-437f-8e10-1fe088afa145
type: derived