{"id":"651f87f7-12db-47f9-84c5-f27b081b94b6","title":"RegAsm.EXE Execution Without CommandLine Flags or Files","description":"Detects the execution of \"RegAsm.exe\" without a commandline flag or file, which might indicate potential process injection activity.\nUsually \"RegAsm.exe\" should point to a dedicated DLL file or call the help with the \"/?\" flag.\n","author":"frack113","status":"experimental","level":"low","date":"2025-06-04","modified":"","tags":["attack.stealth","attack.t1218.009"],"technique_ids":["T1218.009"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Legitimate use of Regasm by developers."],"references":["https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/","https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla","https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool","https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2","https://www.joesandbox.com/analysis/1467354/0/html"],"source_path":"rules/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml","source_sha256":"1d74a5328768213273575722cb6a414ef95e82abfa86a1d88ed28971fe8b97cd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: RegAsm.EXE Execution Without CommandLine Flags or Files\nid: 651f87f7-12db-47f9-84c5-f27b081b94b6\nstatus: experimental\ndescription: |\n    Detects the execution of \"RegAsm.exe\" without a commandline flag or file, which might indicate potential process injection activity.\n    Usually \"RegAsm.exe\" should point to a dedicated DLL file or call the help with the \"/?\" flag.\nreferences:\n    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/\n    - https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla\n    - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool\n    - https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2\n    - https://www.joesandbox.com/analysis/1467354/0/html\nauthor: frack113\ndate: 2025-06-04\ntags:\n    - attack.stealth\n    - attack.t1218.009\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith: '\\RegAsm.exe'\n        - OriginalFileName: 'RegAsm.exe'\n    selection_cli:\n        CommandLine|endswith:\n            - 'RegAsm'\n            - 'RegAsm.exe'\n            - 'RegAsm.exe\"'\n            - \"RegAsm.exe'\"\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate use of Regasm by developers.\n# Note: You can increase after an initial baseline\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.009","id":"T1218.009","name":"Regsvcs/Regasm","page":"techniques/enterprise/T1218.009/"}],"data_path":"data/detection-rules/651f87f7-12db-47f9-84c5-f27b081b94b6.json","kind":"sigma"}