From 2ce3a6adcbb17a5fdf597d54942aef2015bf4ba9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <76067280+mhaag-spl@users.noreply.github.com>
Date: Tue, 9 Feb 2021 14:01:59 -0700
Subject: [PATCH] Update suspicious_regsvr32_activity.yml

---
 stories/suspicious_regsvr32_activity.yml | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml
index cc922fe190..028bd5d873 100644
--- a/stories/suspicious_regsvr32_activity.yml
+++ b/stories/suspicious_regsvr32_activity.yml
@@ -8,9 +8,29 @@ narrative: 'One common adversary tactic is to bypass application control solutio
   via the regsvr32.exe process. This particular bypass was popularized with "SquiblyDoo"
   using the "scrobj.dll" dll to load .sct scriptlets. This technique is still widely used
   by adversaries to bypass detection and prevention controls. 
-  The file extension of the DLL is irrelevant (it may load a .txt for example). 
+  The file extension of the DLL is irrelevant (it may load a .txt file extension for example). 
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code.'
+  may indicate that an adversary is leveraging regsvr32.exe to execute malicious code. \
+  
+  Triage\
+  Validate execution \
+  1. Determine if regsvr32.exe executed. Validate the OriginalFileName of regsvr32.exe and further
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.\
+  
+  1. Determine if script code was executed with regsvr32.\
+  
+  Situational Awareness\
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by regsvr32.exe.\
+
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application?\
+
+  1. Module loads.  Is regsvr32 loading any suspicious .DLLs? Unsigned or signed from non-standard paths.\
+
+  1. Network connections. Any network connections? Review the reputation of the remote IP or domain.\
+  
+  Retrieval of Script Code\
+  The objective of this step is to confirm the executed script code is benign or malicious.'
 author: Michael Haag, Splunk
 type: ESCU
 references: