Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
regsvcs.exe AllTheThingsx64.dll
Loads the target .DLL file and executes the RegisterClass function.
Execute dll file and bypass Application whitelisting
c:\Windows\Microsoft.NET\Framework\v*\regsvcs.exe, c:\Windows\Microsoft.NET\Framework64\v*\regsvcs.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_regasm.yml, Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/execution_register_server_program_connecting_to_the_internet.toml, Splunk: https://github.com/splunk/security_content/blob/bee2a4cefa533f286c546cbe6798a0b5dec3e5ef/detections/endpoint/detect_regsvcs_with_network_connection.yml
Casey Smith (@subtee)