HUNTS- Regsvcs/Regasm (T1121)

HUNTS- Regsvcs/Regasm (T1121)

Version 1.0

ATT&CK Technique: Regsvcs/Regasm (T1121)

What this playbook hunts for:

• Processes spawned by Regsvcs.exe or Regasm.exe. Regsvcs.exe and Regasm.exe can be used to register COM objects and execute malicious code. Regsvcs.exe and Regasm.exe are examples of a Living of the Land (LOL) binary, which are native Windows executables that are rarely blocked by Applocker or anti-virus software.

How the playbook works:

• Generates SIEM query for Sysmon Event ID 1 logs where Regsvcs.exe or Regasm.exe are invoked with a .DLL file in the command line

• Generates SIEM query for Sysmon Event ID 1 logs where Regsvcs.exe or Regasm.exe are a parent process

What results are expected:

• Name, process ID, and path of the process spawned by Regsvcs.exe or Regasm.exe

• Command line arguments for Regsvcs.exe or Regasm.exe

• MD5 hash of the process spawned by Regsvcs.exe or Regasm.exe

• Child process spawn time

• Hostname of the computer where Regsvcs.exe or Regasm.exe was executed

• User account that was used to execute Regsvcs.exe or Regasm.exe

Common follow-on actions:

• Acquire forensic image

• Sandbox file

• Get running processes

• Get network connections

• Quarantine host

What inputs are necessary:

• SIEM

• Logs: Sysmon Event ID 1: Process creation

• Hunt start time

What subroutine playbooks are needed:

• Create and Link Alerts from Hunt (Host-based)

What configurations are needed:

• Sysmon logging enabled 

False Positive Potential: Low

• Execution of Regsvcs.exe or Regasm.exe is uncommon on most networks. Child processes spawned by Regsvcs.exe or Regasm.exe are even more uncommon and should absolutely be investigated if observed.