Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension

Title: Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
Status: test
Description:Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.
References:
  -https://www.fortiguard.com/threat-signal-report/4718?s=09
  -https://lolbas-project.github.io/lolbas/Binaries/Regasm/
  -https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-13
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218.009'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\Regsvcs.exe'
      - '\Regasm.exe'
    - OriginalFileName:
      - 'RegSvcs.exe'
      - 'RegAsm.exe'
  selection_extension:
    CommandLine|contains:
      -'.dat'
      -'.gif'
      -'.jpeg'
      -'.jpg'
      -'.png'
      -'.txt'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium