Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: <code>[ComRegisterFunction]</code> or <code>[ComUnregisterFunction]</code> respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| PR.PS-05.02 | Mobile code prevention | Mitigates | T1218.009 | Regsvcs/Regasm |
Comments
Mobile code procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CM-06 | Configuration Settings | mitigates | T1218.009 | Regsvcs/Regasm | |
| CM-11 | User-installed Software | mitigates | T1218.009 | Regsvcs/Regasm | |
| SI-16 | Memory Protection | mitigates | T1218.009 | Regsvcs/Regasm | |
| RA-05 | Vulnerability Monitoring and Scanning | mitigates | T1218.009 | Regsvcs/Regasm | |
| CM-08 | System Component Inventory | mitigates | T1218.009 | Regsvcs/Regasm | |
| SI-10 | Information Input Validation | mitigates | T1218.009 | Regsvcs/Regasm | |
| SI-03 | Malicious Code Protection | mitigates | T1218.009 | Regsvcs/Regasm | |
| SI-07 | Software, Firmware, and Information Integrity | mitigates | T1218.009 | Regsvcs/Regasm | |
| CM-02 | Baseline Configuration | mitigates | T1218.009 | Regsvcs/Regasm | |
| CM-07 | Least Functionality | mitigates | T1218.009 | Regsvcs/Regasm | |
| SI-04 | System Monitoring | mitigates | T1218.009 | Regsvcs/Regasm |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Abuse of functionality | Abuse of functionality. | related-to | T1218.009 | Regsvcs/Regasm |