Potentially Suspicious Regsvr32 HTTP IP Pattern

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1218.010` System Binary Proxy Execution: Regsvr32

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\regsvr32.exe'
OriginalFileName: REGSVR32.EXE

Stage 2: `all of selection_ip`

or:
CommandLine|contains: ' -i:http://1'
CommandLine|contains: ' -i:http://2'
CommandLine|contains: ' -i:http://3'
CommandLine|contains: ' -i:http://4'
CommandLine|contains: ' -i:http://5'
CommandLine|contains: ' -i:http://6'
CommandLine|contains: ' -i:http://7'
CommandLine|contains: ' -i:http://8'
CommandLine|contains: ' -i:http://9'
CommandLine|contains: ' -i:https://1'
CommandLine|contains: ' -i:https://2'
CommandLine|contains: ' -i:https://3'
CommandLine|contains: ' -i:https://4'
CommandLine|contains: ' -i:https://5'
CommandLine|contains: ' -i:https://6'
CommandLine|contains: ' -i:https://7'
CommandLine|contains: ' -i:https://8'
CommandLine|contains: ' -i:https://9'
CommandLine|contains: ' /i:http://1'
CommandLine|contains: ' /i:http://2'
CommandLine|contains: ' /i:http://3'
CommandLine|contains: ' /i:http://4'
CommandLine|contains: ' /i:http://5'
CommandLine|contains: ' /i:http://6'
CommandLine|contains: ' /i:http://7'
CommandLine|contains: ' /i:http://8'
CommandLine|contains: ' /i:http://9'
CommandLine|contains: ' /i:https://1'
CommandLine|contains: ' /i:https://2'
CommandLine|contains: ' /i:https://3'
CommandLine|contains: ' /i:https://4'
CommandLine|contains: ' /i:https://5'
CommandLine|contains: ' /i:https://6'
CommandLine|contains: ' /i:https://7'
CommandLine|contains: ' /i:https://8'
CommandLine|contains: ' /i:https://9'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-i:http://1` `-i:http://2` `-i:http://3` `-i:http://4` `-i:http://5` `-i:http://6` `-i:http://7` `-i:http://8` `-i:http://9` `-i:https://1` `-i:https://2` `-i:https://3` `-i:https://4` `-i:https://5` `-i:https://6` `-i:https://7` `-i:https://8` `-i:https://9` `/i:http://1` `/i:http://2` `/i:http://3` `/i:http://4` `/i:http://5` `/i:http://6` `/i:http://7` `/i:http://8` `/i:http://9` `/i:https://1` `/i:https://2` `/i:https://3` `/i:https://4` `/i:https://5` `/i:https://6` `/i:https://7` `/i:https://8` `/i:https://9`
`Image`	ends_with	`\regsvr32.exe` corpus 57 (sigma 57)
`OriginalFileName`	eq	`REGSVR32.EXE` corpus 10 (sigma 10)