Windows regsvr32 Executes DLLs With /s and /e from Uncommon Paths (Implicit DllRegisterServer)

Alerts on regsvr32.exe /s /e executions of DLLs from potentially suspicious locations that may trigger DllRegisterServer.

FreeUnreviewedSigmamediumv1

windows-regsvr32-executes-dlls-with-s-and-e-from-uncommon-paths-implicit-dllregi-ce2c44b5

title: Windows regsvr32 Executes DLLs With /s and /e from Uncommon Paths (Implicit DllRegisterServer)
id: 30cc0596-f2e8-4429-ada9-cf7471d0a640
related:
  - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
    type: similar
  - id: ce2c44b5-a6ac-412a-afba-9e89326fa972
    type: derived
status: test
description: This rule flags process executions of regsvr32.exe where the command line includes the silent (/s) and export (/e) switches, and the target DLL path or working directory is limited to commonly seen system and program locations not being matched. In this invocation pattern, regsvr32 can implicitly call the DLL export function DllRegisterServer, which attackers may use to run attacker-controlled code via COM/DLL registration behavior. The detection relies on Windows process creation telemetry, including Image/OriginalFileName, CommandLine, and CurrentDirectory.
references:
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://www.virustotal.com/gui/file/288fc4f954f98d724e6fab32a89477943df5c0e9662cb199a19b90ae0c63aebe/detection
  - https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver
  - https://ss64.com/nt/regsvr32.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_regsvr32_dllregisterserver_exec.yml
author: Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-17
tags:
  - attack.stealth
  - attack.t1218
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    - Image|endswith: \regsvr32.exe
    - OriginalFileName: REGSVR32.EXE
  selection_cmdline:
    CommandLine|contains:
      - " /s "
      - " /e "
  filter_main_paths:
    - CommandLine|contains:
        - :\Program Files (x86)
        - :\Program Files\
        - :\Windows\System32\
        - :\Windows\SysWOW64\
    - CurrentDirectory|contains:
        - :\Program Files (x86)
        - :\Program Files\
        - :\Windows\System32\
        - :\Windows\SysWOW64\
  filter_main_other_flags:
    CommandLine|contains:
      - " /i:"
      - "/U "
  filter_main_rpcproxy:
    ParentCommandLine|endswith: :\Windows\System32\RpcProxy\RpcProxy.dll
    CommandLine: regsvr32 /s rpcproxy.dll
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate usage as part of application installation, but less likely from e.g. temporary paths.
level: medium
license: DRL-1.1

What it detects

This rule flags process executions of regsvr32.exe where the command line includes the silent (/s) and export (/e) switches, and the target DLL path or working directory is limited to commonly seen system and program locations not being matched. In this invocation pattern, regsvr32 can implicitly call the DLL export function DllRegisterServer, which attackers may use to run attacker-controlled code via COM/DLL registration behavior. The detection relies on Windows process creation telemetry, including Image/OriginalFileName, CommandLine, and CurrentDirectory.

Known false positives

Legitimate usage as part of application installation, but less likely from e.g. temporary paths.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.