name: Detect Regsvr32 Application Control Bypass
id: 070e9b80-6252-11eb-ae93-0242ac130002
version: 1
date: '2021-01-28'
author: Michael Haag, Splunk
type: batch
datamodel:
- Endpoint
description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
  Regsvr32.exe is a command-line program used to register and unregister object linking
  and embedding controls, including dynamic link libraries (DLLs), on Windows systems.
  Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is
  often referred to as a "Squiblydoo" attack. \

  Upon investigating, look for network connections to remote destinations (internal
  or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll"
  is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon
  execution. '
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe
  OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest
  Processes.user Processes.parent_process Processes.process_name Processes.process
  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter`'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints, to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model. Tune the query by modifying/removing the !=regsv32.exe.
known_false_positives: Limited false positives related to third party software registering
  .DLL's.
references:
- https://attack.mitre.org/techniques/T1218/010/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
tags:
  analytic_story:
  - Suspicious Regsvr32 Activity
  - Cobalt Strike
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1218.010
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process_name
  - Processes.process
  - Processes.dest
  - Processes.user
  - Processes.parent_process
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
