Merge pull request #1 from grepstrength/grepstrength-patch-1

Add files via upload

Author: grepstrength

rules/windows/process_creation/proc_creation_win_regsvcs_suspicious_calltrace.yml

@@ -0,0 +1,32 @@
+title: Suspicious Shellcode Injection into RegSvcs.exe
+id: 42833cf3-dd1d-4530-8c87-90c55393ad42
+status: experimental
+description: Detects potential shellcode injection into RegSvcs.exe based on suspicious Windows API calls. 
+references:
+  - https://osintteam.blog/opened-a-can-of-xworms-33fde9d2aee6
+author: Kelvin "grepStrength" Winborne
+date: 2025/10/15
+tags:
+  - attack.execution
+  - attack.t1055
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection:
+    Image|endswith: '\RegSvcs.exe'
+    OriginalFileName: 'RegSvcs.exe'
+  suspicious_behavior:
+    - CallTrace|contains: 'VirtualAlloc'
+    - CallTrace|contains: 'WriteProcessMemory'
+    - CallTrace|contains: 'CreateRemoteThread'
+    - CallTrace|contains: 'NtProtectVirtualMemory'
+  condition: selection and 1 of suspicious_behavior
+fields:
+  - Image
+  - ParentImage
+  - CommandLine
+  - CallTrace
+falsepositives:
+  - Known .NET assembly registration
+level: high