T1218.009 — Regsvcs/Regasm

Tactic: Stealth · Platforms: Windows

Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. Both…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.009 System Binary Proxy Execution: Regsvcs/Regasm

title: "T1218.009 System Binary Proxy Execution: Regsvcs/Regasm"
id: cde0ebff-8ec2-40e2-af09-8c3e619cd605
description: 'Detecting .NET COM Registration Abuse via Regsvcs/Regasm Execution. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: AssemblyPathRegex, SuspiciousFlags, ParentProcessAllowList, KnownGoodAssemblies, RegistryKeyAllowList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1218/009
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.stealth
  - attack.t1218.009

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    EventID: '1'
    Image|endswith:
      - '\Regsvcs.exe'
      - '\Regasm.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate .NET COM assembly registration during software installation.

level: medium

Related sub-techniques

Explore