Vidar - RegAsm Proxy Execution (T1218)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Hunts for the reflective .NET loader dynamically invoking methods while spawning RegAsm.exe as the execution proxy. This rule detects when 'RegAsm.exe' is spawned by 'powershell.exe' and is associated with an 'AllocateVirtualMemoryApiCall' event, indicating potential reflective code loading and execution.