Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1218.010

Regsvr32

Stealth 42 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Unusual Network Activity from a Windows System Binary production 2026-10-19
elastic Suspicious Windows Command Shell Arguments production 2026-10-09
splunk Regsvr32 Silent and Install Param Dll Loading production 2026-10-02
splunk Detect Regsvr32 Application Control Bypass production 2026-10-02
splunk Windows Regsvr32 Renamed Binary deprecated 2026-09-23
elastic Potential Command and Control via Internet Explorer production 2026-09-18
elastic Service Control Spawned via Script Interpreter production 2026-09-18
elastic Execution of Persistent Suspicious Program production 2026-09-18
elastic Suspicious Explorer Child Process production 2026-09-18
elastic Suspicious MS Outlook Child Process production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Suspicious JetBrains TeamCity Child Process production 2026-09-18
elastic Suspicious PDF Reader Child Process production 2026-09-18
elastic Network Connection via Registration Utility production 2026-09-18
elastic Execution from Unusual Directory - Command Line production 2026-09-18
elastic Delayed Execution via Ping production 2026-09-18
elastic Suspicious Script Object Execution production 2026-09-18
elastic Suspicious Managed Code Hosting Process production 2026-09-18
elastic Suspicious Execution from a Mounted Device production 2026-09-18
elastic Suspicious .NET Code Compilation production 2026-09-18
splunk Windows IOBit Unlocker Extension DLL Registration via Regsvr32 production 2026-05-13
splunk Malicious InProcServer32 Modification production 2026-05-13
splunk Suspicious Regsvr32 Register Suspicious Path production 2026-05-13
sigma Unsigned DLL Loaded by Windows Utility test 2025-10-07
sigma Regsvr32 DLL Execution With Suspicious File Extension test 2025-08-27
sigma Potential Regsvr32 Commandline Flag Anomaly test 2024-03-13
sigma Suspicious WmiPrvSE Child Process test 2023-11-10
sigma DNS Query Request By Regsvr32.EXE test 2023-09-18
sigma Network Connection Initiated By Regsvr32.EXE test 2023-09-18
sigma Potentially Suspicious Regsvr32 HTTP/FTP Pattern test 2023-05-26
sigma Regsvr32 Execution From Highly Suspicious Location test 2023-05-26
sigma Regsvr32 Execution From Potential Suspicious Location test 2023-05-26
sigma Potentially Suspicious Child Process Of Regsvr32 test 2023-05-26
sigma Scripting/CommandLine Process Spawned Regsvr32 test 2023-05-26
sigma Potentially Suspicious Regsvr32 HTTP IP Pattern test 2023-05-24
sigma Suspicious Microsoft Office Child Process test 2023-04-24
sigma Suspicious HH.EXE Execution test 2023-04-12
sigma HTML Help HH.EXE Suspicious Child Process test 2023-04-12
sigma Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32 test 2023-03-29
sigma Potential EmpireMonkey Activity test 2023-03-09
sigma Suspicious WMIC Execution Via Office Process test 2023-02-14
sigma Suspicious Regsvr32 Execution From Remote Share test 2022-10-31