name: Regsvr32 scriptlet execution
id: 128f5254-67c9-43ac-b901-18b3731b1d0b
version: 1.0.0
description: |
  Identifies the execution of a scriptlet file by regsvr32.exe process. regsvr32.exe
  allows attackers to run arbitrary scripts to proxy execution of malicious code.
labels:
  tactic.id: TA0005
  tactic.name: Defense Evasion
  tactic.ref: https://attack.mitre.org/tactics/TA0005/
  technique.id: T1218
  technique.name: System Binary Proxy Execution
  technique.ref: https://attack.mitre.org/techniques/T1218/
  subtechnique.id: T1218.010
  subtechnique.name: Regsvr32
  subtechnique.ref: https://attack.mitre.org/techniques/T1218/010/

condition: >
  spawn_process
    and
  (ps.child.name ~= 'regsvr32.exe' or ps.child.pe.file.name ~= 'regsvr32.exe')
    and
  (
    (ps.child.cmdline imatches '*scrobj*'
      and
     ps.child.cmdline imatches
      (
        '*/i:*',
        '*-i:*',
        '*.sct*'
      )
    )
      or
    (ps.child.cmdline imatches '* /u*'
      and
     ps.child.cmdline imatches
      (
        '* -i:*http*',
        '* /i:*http*',
        '* -i:*ftp*',
        '* /i:*ftp*',
        '* -i:C:\\*',
        '* /i:\"C:\\*',
        '* /i:C:\\*',
        '* -i:\"C:\\*'
      )
    )
      or
    (ps.child.cmdline imatches
      (
        '* /i:*',
        '* -i:*'
      )
      and
      not
     ps.child.cmdline imatches
      (
        '* /n*',
        '* -n*'
      )
    )
  )
    and
    not
  ps.child.exe imatches
    (
      '?:\\Program Files\\*.exe',
      '?:\\Program Files (x86)\\*.exe'
    )

min-engine-version: 2.2.0
