REGISTER_APP.VBS Proxy Execution

Title: REGISTER_APP.VBS Proxy Execution
Status: test
Description:Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.
References:
  -https://twitter.com/sblmsrsn/status/1456613494783160325?s=20
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'\register_app.vbs'
      -'-register'

  condition:selection
Falsepositives:
  -Legitimate usage of the script. Always investigate what's being registered to confirm if it's benign
Level: medium