Network Connection via Registration Utility

Last updated 5 months ago on 2025-03-20

Created 6 years ago on 2020-02-18

About

Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or RegAsm.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary.

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: ExecutionTactic: Defense EvasionData Source: Elastic DefendData Source: SysmonLanguage: eql

Severity

low

Risk Score

MITRE ATT&CK™

Execution (TA0002)(opens in a new tab or window)

Defense Evasion (TA0005)(opens in a new tab or window)

↳ System Binary Proxy Execution (T1218)(opens in a new tab or window)

False Positive Examples

Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual.

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

winlogbeat-*logs-endpoint.events.process-*logs-endpoint.events.network-*logs-windows.sysmon_operational-*

Related Integrations

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

Query

sequence by process.entity_id
  [process where host.os.type == "windows" and event.type == "start" and
   process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe") and
   not (
         (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System") and
         (process.parent.name : "msiexec.exe" or process.parent.executable : ("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe"))
       )
   ]
  [network where host.os.type == "windows" and process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe")  and
   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8") and network.protocol != "dns"]

Install detection rules in Elastic Security

Detect Network Connection via Registration Utility in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).