Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1218.009sub-technique of T1218 System Binary Proxy Execution

Regsvcs/Regasm

Windowsnothing on this site yetT1218.009 on attack.mitre.org

Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register.NET Component Object Model (COM) assemblies. Both are binaries that may be digitally signed by Microsoft.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detecting.NET COM Registration Abuse via Regsvcs/Regasm

  • Abuse of Regsvcs.exe or Regasm.exe to execute arbitrary code embedded in.NET assemblies via [ComRegisterFunction]/[ComUnregisterFunction]. Behavioral chain: (1) Process creation of regsvcs/regasm with suspicious assembly paths/flags → (2) Assembly/DLL load inside regsvcs/regasm → (3) Registry writes to...

what reduces it

  • M1038 Execution Prevention. Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.
  • M1042 Disable or Remove Feature or Program. Regsvcs and Regasm may not be necessary within a given environment.

the rest of T1218

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.