Signed Binary Proxy Execution: Regsvcs/Regasm

Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. [1] [2]

Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. [3][4]

ID: T1218.009
Sub-technique of:  T1218
Tactic: Defense Evasion
Platforms: Windows
Permissions Required: Administrator, User
Data Sources: Process command-line parameters, Process monitoring
Defense Bypassed: Application control, Digital Certificate Validation
Contributors: Casey Smith
Version: 1.0
Created: 23 January 2020
Last Modified: 20 June 2020

Mitigations

Mitigation Description
Disable or Remove Feature or Program

Regsvcs and Regasm may not be necessary within a given environment.

Execution Prevention

Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.

Detection

Use process monitoring to monitor the execution and arguments of Regsvcs.exe and Regasm.exe. Compare recent invocations of Regsvcs.exe and Regasm.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after Regsvcs.exe or Regasm.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

References