System Binary Proxy Execution: Regsvcs/Regasm

Created the Sunday 05 March 2023. Updated 1 year, 1 month ago.

Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft.

Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute

Technique Identifier

T1218.009

Technique Tags

Defense Evasion register .NET Component Object Model (COM) assemblies bypass application control [ComRegisterFunction] [ComUnregisterFunction]

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

System Binary Proxy Execution: Regsvcs/Regasm, Sub-technique T1218.009 - Enterprise | MITRE ATT&CK®