Windows regsvr32 DLLLoad from AppData Local containing DllEntry

Alerts when regsvr32 loads a DLL from AppData\Local with a DllEntry reference.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-10-02
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.010Regsvr32
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where regsvr32 is invoked with a DLL path under \AppData\Local\ and command-line content that includes .dll and DllEntry. Such usage can indicate an attempt to load a DLL through a signed binary to execute code or stage payloads while blending into normal system behaviors. It relies on process creation telemetry, matching the command line for regsvr32 and the expected DLL-related substrings.

Reporting behind it

Related detections9 linkedT1218.010 — drag to rearrange

Suspicious Regsvr32 Execution of SafePay Loader DLL

Suspicious Scheduled Task Running Regsvr32 with Extreme Duration by StaryDobry

Malicious DynamicWrapperX Registration via regsvr32 (via process_creation)

Suspicious Run Key Persistence Executing regsvr32

Suspicious regsvr32 Registering DLL from User AppData

Malicious Regsvr32 Loading Masqueraded VPN DLL via Process Creation

Malicious Regsvr32 ShellExec_RunDLL Proxy Execution (via process_creation)

Suspicious DLL Execution via Regsvr32 DllInstall of dat File

Malicious Xctdoor XcLoader Execution via Regsvr32 AppX Path Abuse (via process_creation)

Windows regsvr32 DLLLoad from AppData Local containing DllEntry

Pivot detection · T1218.010 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-regsvr32-launches-appdata-local-dlls-referencing-dllentry-bd70d3f8

title: Windows regsvr32 DLLLoad from AppData Local containing DllEntry
id: 6048aaf1-982b-49b0-b42a-9d5e39db5e5d
status: test
description: This rule flags Windows process creation where regsvr32 is invoked with a DLL path under \AppData\Local\ and command-line content that includes .dll and DllEntry. Such usage can indicate an attempt to load a DLL through a signed binary to execute code or stage payloads while blending into normal system behaviors. It relies on process creation telemetry, matching the command line for regsvr32 and the expected DLL-related substrings.
references:
  - https://pbs.twimg.com/media/EF3yLGoWkAEGeLa?format=jpg
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/TA/APC-C-12/proc_creation_win_apt_aptc12_bluemushroom.yml
author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-02
modified: 2023-03-29
tags:
  - attack.stealth
  - attack.t1218.010
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - regsvr32
      - \AppData\Local\
      - .dll
      - ",DllEntry"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bd70d3f8-e60e-4d25-89f0-0b5a9cff20e0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL