regasm.exe

Microsoft .NET Assembly Registration Utility file version info (xCyclopedia)

LOLBAS AWL Bypass, Execute 7 Sigma rules name it 1 ATT&CK technique 2 documented commands 4 known copies with hashes

How regasm.exe is abused

documented by LOLBAS

AWL Bypass T1218.009 System Binary Proxy Execution: Regsvcs/Regasm

Execute T1218.009 System Binary Proxy Execution: Regsvcs/Regasm

-u

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for regasm.exe.

2 documented commands

from LOLBAS, each read by the identifier

AWL Bypass T1218.009 System Binary Proxy Execution: Regsvcs/Regasm Local Admin privileges

Loads the target .NET DLL file and executes the RegisterClass function.

regasm.exe {PATH:.dll}

Identify

Execute T1218.009 System Binary Proxy Execution: Regsvcs/Regasm User privileges

Loads the target .DLL file and executes the UnRegisterClass function.

regasm.exe /U {PATH:.dll}

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for regasm.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for regasm.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPotentially Suspicious Execution Of Regasm/Regsvcs With Uncommon ExtensionNasreddine Bencherchali (Nextron Systems)

mediumPotentially Suspicious Execution Of Regasm/Regsvcs From Uncommon LocationNasreddine Bencherchali (Nextron Systems)

lowRegAsm.EXE Execution Without CommandLine Flags or Filesfrack113

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highBad Opsec Defaults Sacrificial Processes With Improper ArgumentsOleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

highPotential PowerShell Execution Via DLLMarkus Neis, Nasreddine Bencherchali (Nextron Systems)

T1218.009System Binary Proxy Execution: Regsvcs/Regasm

Is it the real regasm.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionMicrosoft .NET Assembly Registration Utility

4 known copies

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe · signed by Microsoft Windows

1136010a4706295f80343fe364d90d5789288dead5ab0ed0e0981d29ad669bbc

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe · signed by Microsoft Windows

53195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe · signed by Microsoft Windows

c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe · signed by Microsoft Windows

dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.