LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Regasm.exe

View source

Part of .NET

AWL BypassExecute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

AWL Bypass1

EXAMPLE 01T1218.009

Loads the target .NET DLL file and executes the RegisterClass function.

COMMAND
regasm.exe {PATH:.dll}
USE CASE
Execute code and bypass Application whitelisting
PRIVILEGES
Local Admin
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL (.NET)

Execute1

EXAMPLE 01T1218.009

Loads the target .DLL file and executes the UnRegisterClass function.

COMMAND
regasm.exe /U {PATH:.dll}
USE CASE
Execute code and bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL (.NET)
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regasm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources

Indicators & detection notes

  • IOC

    regasm.exe executing dll file

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee