Detect COM registration utility running a user-writable assembly

Siemphony@siemphonyhighT1218.009verified in labPlaybook · Unexpected execution

Matches process creation of the .NET COM registration utilities where the command line points at an assembly under a user-writable directory or a UNC share — MITRE's AssemblyPathRegex knob from AN1028 made concrete. AN1028 describes a four-stage chain (assembly dropped, regsvcs/regasm executed, HKCR CLSID/ProgID writes during registration, then a child process or egress) correlated inside a 5–10 minute window; Sigma expresses no join and no timeframe, so this rule is stage two alone, narrowed by path so that it is not merely "a signed Microsoft binary ran". The last path entry is a literal double backslash, which matches a UNC source anywhere in the command line. The SuspiciousFlags knob (/u, /codebase, /regfile) is deliberately not ORed in: uninstallers use /u routinely, and a flag match would swamp the path match. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0361, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Detect COM registration utility running a user-writable assembly2id: a57469e6-4a78-4179-9b84-7f46a42ee6643status: experimental4description: |5  Matches process creation of the .NET COM registration utilities where the6  command line points at an assembly under a user-writable directory or a UNC7  share — MITRE's AssemblyPathRegex knob from AN1028 made concrete. AN10288  describes a four-stage chain (assembly dropped, regsvcs/regasm executed,9  HKCR CLSID/ProgID writes during registration, then a child process or egress)10  correlated inside a 5–10 minute window; Sigma expresses no join and no11  timeframe, so this rule is stage two alone, narrowed by path so that it is not12  merely "a signed Microsoft binary ran". The last path entry is a literal13  double backslash, which matches a UNC source anywhere in the command line.14  The SuspiciousFlags knob (/u, /codebase, /regfile) is deliberately not ORed in:15  uninstallers use /u routinely, and a flag match would swamp the path match.16  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0361, not hand-written and not tested by its author. Any lab result is on this rule's own page.17references:18  - https://attack.mitre.org/techniques/T1218/00919  - https://attack.mitre.org/detectionstrategies/DET036120author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)21date: 2026-08-1622tags:23  - attack.defense-evasion24  - attack.t1218.00925logsource:26  category: process_creation27  product: windows28detection:29  registration_utility:30    Image|endswith:31      - '\regsvcs.exe'32      - '\regasm.exe'33  untrusted_assembly_path:34    CommandLine|contains:35      - '\AppData\Local\Temp\'36      - '\AppData\Roaming\'37      - '\Downloads\'38      - '\Users\Public\'39      - '\Windows\Temp\'40      - '\ProgramData\'41      - '\\\\'42  condition: registration_utility and untrusted_assembly_path43falsepositives:44  - "Software installers and MSI custom actions that stage a .NET assembly in %TEMP% or %ProgramData% and register it there. This is the exact shape the rule looks for; MITRE's ParentProcessAllowList knob is the discriminator, so add ParentImage exclusions for msiexec.exe and your packaging tooling rather than removing the path entries."45  - "Developer build and test loops. Visual Studio post-build steps and CI agents invoke regasm against assemblies in a working directory that frequently sits under %TEMP% or a mapped UNC build share, matching both selections dozens of times a day on engineering hosts."46  - "Deployment from a file server. Line-of-business applications installed straight off `\\server\\share` produce the UNC match, which is why MITRE pairs AssemblyPathRegex with KnownGoodAssemblies — pin the approved publisher or hash before this rule is usable in an estate that deploys over SMB."47level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\regsvcs.exe" or FolderPath endswith "\\regasm.exe") and (ProcessCommandLine contains "\\AppData\\Local\\Temp\\" or ProcessCommandLine contains "\\AppData\\Roaming\\" or ProcessCommandLine contains "\\Downloads\\" or ProcessCommandLine contains "\\Users\\Public\\" or ProcessCommandLine contains "\\Windows\\Temp\\" or ProcessCommandLine contains "\\ProgramData\\" or ProcessCommandLine contains "\\\\"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\regsvcs.exe" OR Image="*\\regasm.exe") AND (CommandLine="*\\AppData\\Local\\Temp\\*" OR CommandLine="*\\AppData\\Roaming\\*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*\\Windows\\Temp\\*" OR CommandLine="*\\ProgramData\\*" OR CommandLine="*\\\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\regsvcs.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regasm.exe") AND (TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\roaming\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\downloads\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\windows\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\regsvcs\.exe$|\\regasm\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\Downloads\\|\\Users\\Public\\|\\Windows\\Temp\\|\\ProgramData\\|\\\\)</field>    <description>Detect COM registration utility running a user-writable assembly</description>    <mitre>      <id>T1218.009</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a57469e6-4a78-4179-9b84-7f46a42ee664

ATT&CKT1218.009

T1218.009Regsvcs/Regasm

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — Regasm/Regsvcs proxy execution
passed
Siemphony IR · 3 Sept 2026
13 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.009, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Invert the path test. Sigma expresses "regsvcs/regasm whose CommandLine
OR OriginalFileName|endswith: ['\RegSvcs.exe', '\RegAsm.exe'] into
Add '\OneDrive\' and '\AppData\Local\Apps\2.0\', and exclude ClickOnce by
On Elastic, treat the UNC entry as broken until the ES|QL translator's

Declared by the author

Software installers and MSI custom actions that stage a .NET assembly in %TEMP% or %ProgramData% and register it there. This is the exact shape the rule looks for; MITRE's ParentProcessAllowList knob is the discriminator, so add ParentImage exclusions for msiexec.exe and your packaging tooling rather than removing the path entries.
Developer build and test loops. Visual Studio post-build steps and CI agents invoke regasm against assemblies in a working directory that frequently sits under %TEMP% or a mapped UNC build share, matching both selections dozens of times a day on engineering hosts.
Deployment from a file server. Line-of-business applications installed straight off \server\share produce the UNC match, which is why MITRE pairs AssemblyPathRegex with KnownGoodAssemblies — pin the approved publisher or hash before this rule is usable in an estate that deploys over SMB.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

regsvcs.exe or regasm.exe — two Microsoft-signed .NET COM registration utilities — executing against an assembly in a user-writable directory or on an SMB share. Both binaries run any method marked [ComRegisterFunction] or [ComUnregisterFunction] during registration, even when registration itself fails for want of privilege. That is why they are LOLBins: arbitrary .NET code executed inside a trusted, signed, Microsoft process. Because the binary is signed and legitimate, "a signed Microsoft binary ran" is not an alert. The rule has to narrow, and the narrowing it picks is where the assembly lives. That choice is the whole design.

02 · Telemetry you need

category: process_creation, product: windows — verbatim from AN1028's
CommandLine carries the entire detection. On Security 4688 it is populated

03 · How the logic works

The last path entry is the trap knowledge/gotchas.md §1 exists for. '\\' in Sigma is one literal backslash — write the UNC prefix that way and the gate becomes "contains a backslash", which every Windows path satisfies, so the selection is silently always true. The author wrote '\\\\': four backslashes in the YAML, which the escape layer collapses to two. Verify rather than trust — the Sentinel, SPL and Wazuh renderings all emit a literal two-backslash match. (ES|QL is the exception, and it is a translator bug: LIKE "*\\\\*" hands LIKE the pattern \\, read as one escaped backslash. On Elastic alone this rule is currently "any regsvcs/regasm execution".) Note also what the rule deliberately does not do. MITRE's SuspiciousFlags knob names /u, /codebase and /regfile; the author left them out and said why — uninstallers use /u routinely, so ORing a flag match into the path match would swamp it. That is the reasoning to imitate: a term belongs in the logic only if it adds separation, and in the tuning notes otherwise. Attribution: AssemblyPathRegex is MITRE's knob, described as "environment-specific paths to flag (e.g., %TEMP%, Downloads, OneDrive, SMB shares)". The six concrete directory strings are the author's rendering of it. ParentProcessAllowList, KnownGoodAssemblies, RegistryKeyAllowList, SignedToUnsignedTransition and TimeWindow are MITRE's other knob names, none implemented here.

04 · Common false positives

Two of the six entries — \ProgramData\ and \AppData\Roaming\ — are among the largest write surfaces on Windows, and the case that decides whether level: high is defensible is ClickOnce. .NET line-of-business applications deployed that way live under \AppData\Roaming\ or in the ClickOnce store at \AppData\Local\Apps\2.0\, and register COM components on first launch and after every auto-update: per user, per update, indefinitely. The rule's first false positive suggests excluding msiexec.exe by ParentImage; that does not touch ClickOnce, which has no installer parent to exclude on.
Alongside that: MSI custom actions staging an assembly in %TEMP%, CI agents and post-build steps calling regasm against a working directory, and software installed straight off a UNC share, which the '\\\\' entry catches by design.
And now the inverse — where it will be silent, which is the more important half. The path selection is a denylist of six directories, so the assembly only has to live somewhere else. C:\Users\<u>\Documents\, C:\Users\<u>\Desktop\, C:\PerfLogs\ and C:\Windows\Tasks\ are all user-writable and all miss. Worse, a relative invocation removes the path from the command line entirely: cd %TEMP% && regsvcs.exe evil.dll executes from a directory that is on the list while leaving no directory string for CommandLine|contains to find. Read the six entries as what they are — a list of six places an attacker will not put the DLL.
The list also omits \OneDrive\, which MITRE's own knob text names explicitly. In a Known-Folder-Move estate — the Microsoft 365 default — Desktop and Documents are OneDrive paths, making that the largest gap rather than a long-tail one.
Finally, Image|endswith on the two LOLBin names is defeated the same way. Both binaries are freely copyable out of the .NET Framework directory; copy regasm.exe %TEMP%\svc.exe leaves the behaviour unchanged and the rule blind. OriginalFileName (RegSvcs.exe / RegAsm.exe) is a real Sysmon EventID 1 field and is unused.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0361 and never executed against a log line. The rule is contract-clean, including the tag trap this corpus watches for: under ATT&CK v19 technique.tactics is ['stealth'] but sigmaTactics is ['defense-evasion'], and the rule tags the latter — attack.stealth resolves to nothing in any Sigma tooling.
tier_2: means baselining regasm/regsvcs in your estate: on most networks legitimate executions turn out to be rare and enumerable, which is what makes the inverted allowlist practical.
tier_3: means AN1028's full chain — file drop, this execution, the HKCR\CLSID writes registration produces, then a child process or egress, inside a 5–10 minute TimeWindow. Every one of those log sources is in this brief and unauthored.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/a57469e6-4a78-4179-9b84-7f46a42ee664

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect COM registration utility running a user-writable assembly

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it