Command Line
regsvcs.exe AllTheThingsx64.dll
Description
Abuse regsvcs to execute the 'RegisterClass' function of a target DLL.
Risk
High
Risk Reason
This is typically a suspicious action, occurring only in development environments.
Fidelity
High
Fidelity Reason
In most organizations, this will be a rare operation.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1218/009
Description: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
Tactics: