Network Connection Initiated By Regsvr32.EXE

Title: Network Connection Initiated By Regsvr32.EXE
Status: test
Description:Detects a network connection initiated by "Regsvr32.exe"
References:
  -https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
  -https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
Author: Dmitriy Lifanov, oscd.community
Date: 2019-10-25
modified:2023-09-18
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1559.001'
• -'attack.t1218.010'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    Image|endswith: '\regsvr32.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: medium