Regsvcs and Regasm are Windows command line utilities that register .NET Component Object Model (COM) assemblies. Both may be signed by Microsoft. MITRE ATT&CK tracks their abuse as T1218.009, Regsvcs/Regasm, in the Stealth tactic on Windows.
How attackers use it
According to MITRE, both tools can bypass application control through attributes inside the binary. Code marked with ComRegisterFunction or ComUnregisterFunction runs on registration or unregistration. That code runs even if the process has too few privileges and the registration itself fails. A failed registration is not a safe outcome.
How to detect it
The MITRE strategy describes a chain:
- Process creation of regsvcs.exe or regasm.exe with suspicious assembly paths or flags.
- An assembly or DLL load inside that process.
- Registry writes to HKCR CLSID or ProgID keys during COM registration.
- Optional child processes or network activity spawned by the registration code.
Sysmon event IDs 1, 7 and 13 map to process creation, image load and registry writes. Command lines pointing at user writable folders are a good first filter.
How to reduce the risk
- Block Regsvcs.exe and Regasm.exe through application control if they are not required.
- Remove or disable them where they are not needed.
Why it matters
Both tools matter mainly on developer and build machines. On a standard workstation neither has much of a job, so blocking them is a low cost change. Where they must stay, watch the registry writes to COM class keys that follow a run, since those tie the execution to a specific assembly.
Quick check
Does a failed registration mean no code ran?
No. MITRE notes the code tied to the registration attributes runs even if the process lacks privileges and the registration fails.
Sources
- MITRE ATT&CK, T1218.009: https://attack.mitre.org/techniques/T1218/009
