T1218.009 Regsvcs/Regasm — Detection Rules

Source-backed rule directory

• RegAsm.EXE Initiating Network Connection To Public IP · test · medium · {"category":"network_connection","product":"windows"}
• RegAsm.EXE Execution Without CommandLine Flags or Files · experimental · low · {"product":"windows","category":"process_creation"}
• Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension · test · medium · {"category":"process_creation","product":"windows"}
• Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0361 Detecting .NET COM Registration Abuse via Regsvcs/Regasm

AN1028 Analytic 1028

Abuse of Regsvcs.exe or Regasm.exe to execute arbitrary code embedded in .NET assemblies via [ComRegisterFunction]/[ComUnregisterFunction]. Behavioral chain: (1) Process creation of regsvcs/regasm with suspicious assembly paths/flags → (2) Assembly/DLL load inside regsvcs/regasm → (3) Registry writes to HKCR\CLSID/ProgID during COM registration → (4) Optional child process or network activity spawned by installer/registration code.