Regsvcs/Regasm
Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utilities may be used to bypass application control through use of attributes within the binary to specify...
BY SOURCE
PROCEDURES (12)
Auto-extracted: 3 detections for child process
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for parent process
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for suspicious