Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Title: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Status: test
Description:Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location
References:
  -https://www.fortiguard.com/threat-signal-report/4718?s=09
  -https://lolbas-project.github.io/lolbas/Binaries/Regasm/
  -https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-25
modified:2023-02-13
Tags:

• -'attack.stealth'
• -'attack.t1218.009'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\Regsvcs.exe'
      - '\Regasm.exe'
    - OriginalFileName:
      - 'RegSvcs.exe'
      - 'RegAsm.exe'
  selection_dir:
    CommandLine|contains:
      -'\AppData\Local\Temp\'
      -'\Microsoft\Windows\Start Menu\Programs\Startup\'
      -'\PerfLogs\'
      -'\Users\Public\'
      -'\Windows\Temp\'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium