Windows regsvr32 Execution of calc with /s flag
Alerts on regsvr32.exe runs using /s with a command line ending in calc.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-26
- Updated
- 2026-07-31
What it detects
This rule matches Windows process creation where the executable path ends with regsvr32.exe and the command line includes the silent /s flag while ending with the calc keyword. This pattern is suspicious because regsvr32 is commonly abused to execute payloads and the combination of /s and calc suggests automated execution rather than normal component registration. The detection relies on process creation telemetry, specifically the process image name and full command line.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-regsvr32-execution-with-s-and-calc-keyword-0033cf83
title: Windows regsvr32 Execution of calc with /s flag
id: 008d83ab-90e9-4af3-a68a-94444ddb847f
status: test
description: This rule matches Windows process creation where the executable path ends with regsvr32.exe and the command line includes the silent /s flag while ending with the calc keyword. This pattern is suspicious because regsvr32 is commonly abused to execute payloads and the combination of /s and calc suggests automated execution rather than normal component registration. The detection relies on process creation telemetry, specifically the process image name and full command line.
references:
- https://github.com/pr0xylife/Qakbot/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_regsvr32_calc_pattern.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-26
modified: 2024-03-05
tags:
- attack.execution
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: \regsvr32.exe
CommandLine|contains|windash: " -s"
CommandLine|endswith: " calc"
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 0033cf83-fb87-446d-9cac-43d63ad4d5a9
type: derived