RegAsm.EXE Initiating Network Connection To Public IP

Title: RegAsm.EXE Initiating Network Connection To Public IP
Status: test
Description:Detects "RegAsm.exe" initiating a network connection to public IP adresses
References:
  -https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/
  -https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/
  -https://lolbas-project.github.io/lolbas/Binaries/Regasm/
Author: frack113
Date: 2024-04-25
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218.009'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    Image|endswith: '\regasm.exe'
  filter_main_local_ranges:
    DestinationIp|cidr:
      -'127.0.0.0/8'
      -'10.0.0.0/8'
      -'172.16.0.0/12'
      -'192.168.0.0/16'
      -'169.254.0.0/16'
      -'::1/128'
      -'fe80::/10'
      -'fc00::/7'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium