regsvcs.exe

Microsoft .NET Services Installation Utility file version info (xCyclopedia)

LOLBAS Execute, AWL Bypass 6 Sigma rules name it 1 ATT&CK technique 2 documented commands 4 known copies with hashes

How regsvcs.exe is abused

documented by LOLBAS

Execute T1218.009 System Binary Proxy Execution: Regsvcs/Regasm

AWL Bypass T1218.009 System Binary Proxy Execution: Regsvcs/Regasm

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for regsvcs.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218.009 System Binary Proxy Execution: Regsvcs/Regasm User privileges

Loads the target .NET DLL file and executes the RegisterClass function.

regsvcs.exe {PATH:.dll}

Identify

AWL Bypass T1218.009 System Binary Proxy Execution: Regsvcs/Regasm Local Admin privileges

Loads the target .NET DLL file and executes the RegisterClass function.

regsvcs.exe {PATH:.dll}

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for regsvcs.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for regsvcs.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumPotentially Suspicious Execution Of Regasm/Regsvcs With Uncommon ExtensionNasreddine Bencherchali (Nextron Systems)

mediumPotentially Suspicious Execution Of Regasm/Regsvcs From Uncommon LocationNasreddine Bencherchali (Nextron Systems)

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highBad Opsec Defaults Sacrificial Processes With Improper ArgumentsOleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

highPotential PowerShell Execution Via DLLMarkus Neis, Nasreddine Bencherchali (Nextron Systems)

T1218.009System Binary Proxy Execution: Regsvcs/Regasm

Is it the real regsvcs.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework64\v4.0.30319\
C:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionMicrosoft .NET Services Installation Utility

4 known copies

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe · signed by Microsoft Windows

808aec47f908410c01f820683f1c33198e05525d159863925690fdeb319eac1a

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe · signed by Microsoft Windows

cc2688fba4d9d023d485cabc2900bb8d4bb7c585ace5c878500ffbe5dad3c016

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe · signed by Microsoft Windows

2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe · signed by Microsoft Windows

db727e9d8659d4d711c58b28d11e9e0b63db08fed0de9b6f550288fc8d37d137

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.