Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
25
25
9
3
2
Contributors
15
12
10
9
6
Categories
47
34
13
11
5
Platforms
65
1
Products / Services
20
19
16
6
4
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
IDS Classtypes
2
1
IDS Protocols
3
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
Detects Regsvcs or Regasm used for COM assembly proxy execution
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects the string "ComRegisterFunction" within HTTP response bodies (file.data). This string is associated with .NET assembly registration, specifically when tools like Regsvcs or Regasm are used for 'Assembly Proxy Execution'. This technique is often employed by attackers for defense evasion, as it allows them to execute malicious code via legitimate Microsoft utilities.
The Storm-0408 malvertising campaign uses RegAsm.exe from the .NET Framework as a living-off-the-land binary for command and control. After the initial dropper from GitHub establishes a foothold, the malware injects code into RegAsm.exe to connect to C2 over TCP ports 15647 or 9000, exfiltrate data, and access DPAPI. This rule looks for RegAsm.exe launched from a temp or user writable path, which is unusual because the legitimate RegAsm is typically in the .NET Framework directory. In plain terms, it catches when a normal-looking system tool is being used from the wrong place to talk to an attacker.
Identifies regasm.exe executing a payload disguised as a .txt file, a technique observed in CloudZ RAT intrusions to proxy the execution of its .NET loader.
Regasm Executing Text File Payload
Cortex XDR
Identifies regasm.exe executing a payload disguised as a .txt file. This technique is used by the CloudZ RAT dropper to execute its disguised .NET loader via a scheduled task while evading standard executable-based alerting. The rule specifically looks for 'regasm.exe' in the process image name and '.txt' in the command line, with additional specificity for '/nologo', 'update.txt', or 'msupdate.txt' to narrow down to known campaign indicators.
Detects "RegAsm.exe" initiating a network connection to public IP adresses
Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity.
Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.
Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.
Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.
Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects the MSHTA utility (mshta.exe) executing a remote script which then spawns a .NET registration utility (RegAsm.exe or RegSvcs.exe). This specific execution chain is a high-confidence indicator of malware loaders like XWorm and Lumma Stealer, often delivered via ClickFix social engineering lures.
The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security.
This analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
The following analytic detects the execution of regasm.exe establishing a network connection to a public IP address, excluding private IP ranges. This detection leverages Sysmon EventID 3 logs to identify such behavior. This activity is significant as regasm.exe is a legitimate Microsoft-signed binary that can be exploited to bypass application control mechanisms. If confirmed malicious, this behavior could indicate an adversary's attempt to establish a remote Command and Control (C2) channel, potentially leading to privilege escalation and further malicious actions within the environment.
The following analytic identifies instances of Regsvcs.exe establishing a network connection to a public IP address, excluding private IP ranges. This detection leverages Sysmon EventID 3 logs to monitor network connections initiated by Regsvcs.exe. This activity is significant as Regsvcs.exe, a legitimate Microsoft-signed binary, can be exploited to bypass application control mechanisms and establish remote Command and Control (C2) channels. If confirmed malicious, this behavior could allow an attacker to escalate privileges, persist in the environment, and exfiltrate sensitive data. Immediate investigation and remediation are recommended.
Detects Windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse these programs to proxy execution of malicious code, bypassing application control and potentially evading detection. The rule specifically targets `InstallUtil.exe`, `RegAsm.exe`, `RegSvcs.exe`, `regsvr32.exe`, and `rundll32.exe` when they load DLLs that are not signed or have an invalid signature status. It includes filters for common legitimate scenarios to reduce false positives.
This rule detects the execution of common Windows utilities (PowerShell, Regsvr32, BITSAdmin, Certutil, MSHTA) when initiated by a web browser. This behavior can indicate an attempt to execute malicious code or download additional payloads after a user clicks a malicious link or visits a compromised website. Adversaries often leverage these utilities for various purposes, including code execution, file transfer, and bypassing security controls.
Page 2 of 4