System Binary Proxy Execution: Regsvcs/Regasm
- ID
- T1218.009
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1218 System Binary Proxy Execution
- Platforms
- Windows
- Data sources
- Process Creation, Module Load, Windows Registry Key Creation, Windows Registry Key Modification, File Creation, Command Execution, Network Connection Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. [1] [2]
Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. [3][4]
Detection
- DET0361 Detecting .NET COM Registration Abuse via Regsvcs/Regasm
Data components: Process Creation, Module Load, Windows Registry Key Creation, Windows Registry Key Modification, File Creation, Command Execution, Network Connection Creation
Mitigations (2)
- M1038 Execution Prevention
Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program
Regsvcs and Regasm may not be necessary within a given environment.