Disclosed hacktool set (old stuff) - file regdll.asp

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging legacy hacktools that utilize regdll.asp to register malicious DLLs, a technique often employed for persistence or initial execution in web-based attack scenarios. Proactive hunting is critical within Azure Sentinel because this specific file pattern may indicate an overlooked or dormant threat vector that standard signature-based detections could miss due to its reliance on older tooling artifacts.

YARA Rule

rule aspbackdoor_regdll {
	meta:
		description = "Disclosed hacktool set (old stuff) - file regdll.asp"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
	strings:
		$s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
		$s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
		$s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
		$s5 = "Public Property Get oFS()" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file regdll.asp detection rule, including suggested filters and exclusions:

• Scenario: Legacy Web Server Maintenance via Scheduled Task

  • Context: An automated nightly maintenance job on an IIS server uses a legacy script to re-register ASP components. The scheduled task (Task Scheduler) executes regsvr32.exe or cscript.exe targeting the specific file path C:\InetPub\wwwroot\admin\regdll.asp. This is a standard administrative procedure for older intranets but triggers the “hacktool” signature due to the .asp extension and registration activity.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (cscript.exe or wscript.exe) AND the Parent Process (svchost.exe or Task Scheduler). Additionally, exclude file paths containing \InetPub\wwwroot\admin\.

• Scenario: Deployment of Microsoft System Center Configuration Manager (SCCM)

  • Context: During a software deployment cycle, SCCM agents on endpoint machines execute legacy installation packages that include a custom .asp registration step. The agent process (ccmsetup.exe) invokes the regdll.asp file to register COM objects required for reporting or inventory tools. This legitimate deployment activity mimics the behavior of a disclosed hacktool set.
  • Suggested Filter/Exclusion: Exclude events where the Process Name is ccmexec.exe, ccmsetup.exe, or ccmagent.exe. You may also filter by User Account if deployments run under a specific service account (e.g., DOMAIN\SCCM-Deploy-Svc).

• Scenario: Legacy ERP System Health Checks via PowerShell Script

  • **Context