Regsvcs or Regasm Used for Assembly Proxy Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the string "ComRegisterFunction" within HTTP response bodies (file.data). This string is associated with .NET assembly registration, specifically when tools like Regsvcs or Regasm are used for 'Assembly Proxy Execution'. This technique is often employed by attackers for defense evasion, as it allows them to execute malicious code via legitimate Microsoft utilities.