SigmaHQ/rules/windows/sysmon/sysmon_susp_regsvr32_anomalies.yml

title: Regsvr32 Anomaly
status: experimental
description: Detects various anomalies in relation to regsvr32.exe
author: Florian Roth
logsource:
    product: windows
    service: sysmon
detection:
    # Loads from Temp folder
    selection1:
        EventID: 1
        Image: '*\regsvr32.exe'
        CommandLine: '*\Temp\*'
    # Loaded by powershell
    selection2:
        EventID: 1
        Image: '*\regsvr32.exe'
        ParentImage: '*\powershell.exe'
    # Regsvr32.exe used with http(s) address
    selection3:
        EventID: 1
        Image: '*\regsvr32.exe'
        Commandline: '*/i:http* scrobj.dll'
    condition: selection1 or selection2 or selection3
falsepositives:
    - Unknown
level: high