Windows regsvr32 Execution with /s and calc Keyword

Alerts on regsvr32.exe runs using /s with a command line ending in calc.

FreeUnreviewedSigmahighv1

windows-regsvr32-execution-with-s-and-calc-keyword-0033cf83

title: Windows regsvr32 Execution with /s and calc Keyword
id: 008d83ab-90e9-4af3-a68a-94444ddb847f
status: test
description: This rule flags Windows process creation events where regsvr32.exe is executed with a command line containing the /s switch and ending with the calc keyword. Such usage can indicate attempts to execute or load content via regsvr32 using a scripted or stealthy pattern. The detection relies on process creation telemetry capturing the executed image path and full command line.
references:
  - https://github.com/pr0xylife/Qakbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_regsvr32_calc_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-26
modified: 2024-03-05
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: \regsvr32.exe
    CommandLine|contains|windash: " -s"
    CommandLine|endswith: " calc"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0033cf83-fb87-446d-9cac-43d63ad4d5a9
    type: derived

What it detects

This rule flags Windows process creation events where regsvr32.exe is executed with a command line containing the /s switch and ending with the calc keyword. Such usage can indicate attempts to execute or load content via regsvr32 using a scripted or stealthy pattern. The detection relies on process creation telemetry capturing the executed image path and full command line.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.