cscli scenarios install sigmahq/proc_creation_win_regsvr32_susp_extensions1type: trigger2name: sigmahq/proc_creation_win_regsvr32_susp_extensions3description: |4 Detects the execution of REGSVR32.exe with DLL files masquerading as other files5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\regsvr32.exe' || evt.Parsed.OriginalFileName == 'REGSVR32.EXE') && (evt.Parsed.CommandLine endsWith '.bin' || evt.Parsed.CommandLine endsWith '.bmp' || evt.Parsed.CommandLine endsWith '.cr2' || evt.Parsed.CommandLine endsWith '.dat' || evt.Parsed.CommandLine endsWith '.eps' || evt.Parsed.CommandLine endsWith '.gif' || evt.Parsed.CommandLine endsWith '.ico' || evt.Parsed.CommandLine endsWith '.jpeg' || evt.Parsed.CommandLine endsWith '.jpg' || evt.Parsed.CommandLine endsWith '.nef' || evt.Parsed.CommandLine endsWith '.orf' || evt.Parsed.CommandLine endsWith '.png' || evt.Parsed.CommandLine endsWith '.raw' || evt.Parsed.CommandLine endsWith '.sr2' || evt.Parsed.CommandLine endsWith '.temp' || evt.Parsed.CommandLine endsWith '.tif' || evt.Parsed.CommandLine endsWith '.tiff' || evt.Parsed.CommandLine endsWith '.tmp' || evt.Parsed.CommandLine endsWith '.rtf' || evt.Parsed.CommandLine endsWith '.txt'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1218.0101516 label: "Regsvr32 DLL Execution With Suspicious File Extension"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324