ATT&CK coverage › Technique

System Binary Proxy Execution: Regsvr32 `T1218.010`

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.

Events covered

9 catalog events are tagged with this technique by at least one rule.

Provider	Event ID	Title
Sysmon	1	Process creation
Sysmon	3	Network connection
Sysmon	7	Image loaded
Sysmon	12	RegistryEvent (Object create and delete)
Sysmon	13	RegistryEvent (Value Set)
Sysmon	22	DNSEvent (DNS query)
Security-Auditing	4688	A new process has been created.
Defender-DeviceImageLoadEvents	9006000	Image load (any)
Defender-DeviceProcessEvents	9001000	Process activity (any)

Authoring guide

Patterns shared across the 20 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (11 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`Image`	17	`ends_with` 17, `match` 1, `eq` 1, `starts_with` 1	`\regsvr32.exe`, `\rundll32.exe`, `\MSHTA.EXE`, `\wmic.exe`, `\nltest.exe`
`CommandLine`	12	`match` 10, `ends_with` 2, `is_null` 1, `eq` 1	`\AppData\Local\Temp\`, `-i:`, `-n` , `-u -p` , `/i:http://9`
`OriginalFileName`	9	`eq` 9	`REGSVR32.EXE`, `wmic.exe`, `HH.exe`, `WorkFolders.exe`, `PowerShell.EXE`
`ParentImage`	6	`ends_with` 6, `eq` 1	`\EXCEL.EXE`, `\MSACCESS.EXE`, `\MSPUB.exe`, `\hh.exe`, `\regsvr32.exe`
`InitiatingProcessFileName`	2	`match` 2	`rundll32.exe`, `regsvr32.exe`, `pwsh.exe`, `wscript.exe`, `powershell.exe`
`FileName`	1	`match` 1	`rundll32.exe`, `regsvr32.exe`
`Initiated`	1	`eq` 1	`true`
`Signed`	1	`eq` 1, `is_null` 1	`-`, `true`
`SignatureStatus`	1	`is_null` 1, `eq` 1	`errorExpired`, `Valid`, `-`
`ImageLoaded`	1	`starts_with` 1, `ends_with` 1	`.tmp-\Avira.OE.Setup.CustomActions.dll`, `C:\Windows\Installer\`, `C:\Windows\assembly\NativeImages`
`registry_path`	1	`eq` 1	`"*\\CLSID\\{89565275-A714-4a43-912E-978B935EDCCC}\\InProc...`

Top indicator values (265 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

Field	Kind	Value	Rules (here)	Corpus reach
`Image`	`ends_with`	`\regsvr32.exe`	14	57
`OriginalFileName`	`eq`	`REGSVR32.EXE`	5	10
`Image`	`ends_with`	`\cscript.exe`	4	64
`Image`	`ends_with`	`\wscript.exe`	4	64
`Image`	`ends_with`	`\rundll32.exe`	4	76
`Image`	`ends_with`	`\msiexec.exe`	3	21
`Image`	`ends_with`	`\cmd.exe`	3	92
`Image`	`ends_with`	`\pwsh.exe`	3	140
`Image`	`ends_with`	`\powershell.exe`	3	143
`Image`	`ends_with`	`\schtasks.exe`	3	45
`Image`	`ends_with`	`\mshta.exe`	3	57
`Image`	`ends_with`	`\installutil.exe`	2	5
`Image`	`ends_with`	`\wmic.exe`	2	37
`CommandLine`	`match`	`:\Temp\`	2	14
`CommandLine`	`match`	`\AppData\Local\Temp\`	2	16
`Image`	`ends_with`	`\hh.exe`	2	14
`OriginalFileName`	`eq`	`HH.exe`	2	5
`Image`	`ends_with`	`\verclsid.exe`	2	4
`ParentImage`	`ends_with`	`\wordview.exe`	2	2
`ParentImage`	`ends_with`	`\WINWORD.EXE`	2	3

Common exclusions (1 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

Field	Kind	Value	Rules excluding
`FileName`	`ends_with`	`.dll`	1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 17 rules

DNS Query Request By Regsvr32.EXE severity medium, 1 event, 1 indicator, 0 exclusions
HTML Help HH.EXE Suspicious Child Process severity high, 2 events, 16 indicators, 0 exclusions
Network Connection Initiated By Regsvr32.EXE severity medium, 1 event, 2 indicators, 0 exclusions
Potential Regsvr32 Commandline Flag Anomaly severity medium, 2 events, 3 indicators, 0 exclusions
Potentially Suspicious Child Process Of Regsvr32 severity high, 2 events, 16 indicators, 0 exclusions
Potentially Suspicious Regsvr32 HTTP IP Pattern severity high, 1 event, 38 indicators, 0 exclusions
Potentially Suspicious Regsvr32 HTTP/FTP Pattern severity medium, 1 event, 6 indicators, 0 exclusions
Regsvr32 DLL Execution With Suspicious File Extension severity high, 1 event, 23 indicators, 0 exclusions
Regsvr32 Execution From Highly Suspicious Location severity high, 1 event, 30 indicators, 0 exclusions
Regsvr32 Execution From Potential Suspicious Location severity medium, 1 event, 8 indicators, 0 exclusions
Scripting/CommandLine Process Spawned Regsvr32 severity medium, 2 events, 10 indicators, 0 exclusions
Suspicious HH.EXE Execution severity high, 1 event, 8 indicators, 0 exclusions
Suspicious Microsoft Office Child Process severity high, 1 event, 84 indicators, 0 exclusions
Suspicious Regsvr32 Execution From Remote Share severity high, 1 event, 3 indicators, 0 exclusions
Suspicious WMIC Execution Via Office Process severity high, 1 event, 22 indicators, 0 exclusions
Suspicious WmiPrvSE Child Process severity high, 2 events, 20 indicators, 0 exclusions
Unsigned DLL Loaded by Windows Utility severity medium, 1 event, 27 indicators, 0 exclusions

Splunk 1 rule

Malicious InProcServer32 Modification 2 events, 1 indicator, 0 exclusions

Kusto Query Language 2 rules

Regsvr32 Rundll32 Image Loads Abnormal Extension 2 events, 2 indicators, 1 exclusion
Regsvr32 Rundll32 with Anomalous Parent Process 3 events, 7 indicators, 0 exclusions

System Binary Proxy Execution: Regsvr32 T1218.010