Sigma medium test sigma

Potential Regsvr32 Commandline Flag Anomaly

Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "\\regsvr32.exe",
    "CommandLine
| contains
| windash": " -i:"
  },
  "filter_main_flag": {
    "CommandLine
| contains
| windash": " -n "
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

⚠ Administrator typo might cause some false positives

Field Validations

Loading…

Comments (0)

Loading comments...