HIGH Regsvr32 may have run code from an untrusted source
NEW
ID: #150
|
Created: 2026-01-02 14:52:17
1
Alerts
1
Hosts
3
Files
0
Network
Incident Overview
Process action type = execution AND target process cmd = * /i:*http*, * /i*scrobj.dll* AND target process name = regsvr32.exe
1
2026-01-02 14:52
Unassigned
XDR BIOC
Execution
Affected Hosts & Users
desktop-fnumv3u\user
MITRE ATT&CK Mapping
File Artifacts
3
| File Name | Path | SHA256 | Signature | Verdict | Actions |
|---|---|---|---|---|---|
| regsvr32.exe | - |
022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
|
SIGNATURE_SIGNED | UNKNOWN | VT |
| UltimateXdrGenerator.exe | - |
82fabb35db24a714b179c912f8c0cb90ef174c8db9d6c5bbc59346da7478d82d
|
SIGNATURE_UNSIGNED | UNKNOWN | VT |
| cmd.exe | - |
badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0
|
SIGNATURE_SIGNED | UNKNOWN | VT |
Network Artifacts
0
No network artifacts found for this incident
Process Artifacts
1
| Process | Command Line | Parent Process | User |
|---|---|---|---|
| UltimateXdrGenerator.exe |
"C:\app\cortex-xdr-siem-test\xdr_tools\UltimateXdrGenerator\bin\publish\Ultimate...
|
cmd.exe | DESKTOP-FNUMV3U\User |
Registry Artifacts
0
No registry artifacts found for this incident
Analyst Verdict
HIGH
- Isolate affected endpoints
- Investigate all related alerts
- Document findings
Summary
1
Alerts
1
Hosts
3
Files
0
Network
Alert Categories
Execution
Timeline
01-02 14:52:17
Incident Created
#150 - Regsvr32 may have run code from an untrusted source
01-02 14:52:17
regsvr32.exe
Verdict: Unknown
01-02 14:52:17
UltimateXdrGenerator.exe
Verdict: Unknown
01-02 14:52:17
cmd.exe
Verdict: Unknown
01-02 14:52:09
Regsvr32 may have run code from an untrusted source
high - Detected