Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution
Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-26
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows script and command-line interpreters (for example PowerShell, Wscript, Cmd, and related engines) spawning regsvr32.exe. Attackers may use regsvr32 as a proxy execution technique to load an exported DLL or register components, enabling stealthy execution and living-off-the-land behavior. It relies on process creation telemetry, matching parent process image names and the spawned regsvr32.exe image, with an exclusion for a specific RpcProxy command line pattern.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html
- app.any.runhttps://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution
id: e742162d-790e-482e-8562-36902c9d3e0c
related:
- id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d
type: obsolete
- id: ab37a6ec-6068-432b-a64e-2c7bf95b1d22
type: derived
status: test
description: This rule identifies Windows script and command-line interpreters (for example PowerShell, Wscript, Cmd, and related engines) spawning regsvr32.exe. Attackers may use regsvr32 as a proxy execution technique to load an exported DLL or register components, enabling stealthy execution and living-off-the-land behavior. It relies on process creation telemetry, matching parent process image names and the spawned regsvr32.exe image, with an exclusion for a specific RpcProxy command line pattern.
references:
- https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html
- https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-26
tags:
- attack.stealth
- attack.t1218.010
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
Image|endswith: \regsvr32.exe
filter_main_rpcproxy:
ParentImage: C:\Windows\System32\cmd.exe
CommandLine|endswith: " /s C:\\Windows\\System32\\RpcProxy\\RpcProxy.dll"
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate ".bat", ".hta", ".ps1" or ".vbs" scripts leverage legitimately often. Apply additional filter and exclusions as necessary
- Some legitimate Windows services
level: medium
license: DRL-1.1