Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution

Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.

FreeUnreviewedSigmamediumv1

windows-scripting-engines-spawning-regsvr32-exe-via-parent-process-execution-ab37a6ec

title: Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution
id: e742162d-790e-482e-8562-36902c9d3e0c
related:
  - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d
    type: obsolete
  - id: ab37a6ec-6068-432b-a64e-2c7bf95b1d22
    type: derived
status: test
description: This rule identifies Windows script and command-line interpreters (for example PowerShell, Wscript, Cmd, and related engines) spawning regsvr32.exe. Attackers may use regsvr32 as a proxy execution technique to load an exported DLL or register components, enabling stealthy execution and living-off-the-land behavior. It relies on process creation telemetry, matching parent process image names and the spawned regsvr32.exe image, with an exclusion for a specific RpcProxy command line pattern.
references:
  - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html
  - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-26
tags:
  - attack.stealth
  - attack.t1218.010
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell_ise.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    Image|endswith: \regsvr32.exe
  filter_main_rpcproxy:
    ParentImage: C:\Windows\System32\cmd.exe
    CommandLine|endswith: " /s C:\\Windows\\System32\\RpcProxy\\RpcProxy.dll"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate ".bat", ".hta", ".ps1" or ".vbs" scripts leverage legitimately often. Apply additional filter and exclusions as necessary
  - Some legitimate Windows services
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows script and command-line interpreters (for example PowerShell, Wscript, Cmd, and related engines) spawning regsvr32.exe. Attackers may use regsvr32 as a proxy execution technique to load an exported DLL or register components, enabling stealthy execution and living-off-the-land behavior. It relies on process creation telemetry, matching parent process image names and the spawned regsvr32.exe image, with an exclusion for a specific RpcProxy command line pattern.

Known false positives

Legitimate ".bat", ".hta", ".ps1" or ".vbs" scripts leverage legitimately often. Apply additional filter and exclusions as necessary
Some legitimate Windows services

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.