An attacker has attempted to sideload code by invoking regsvr32.exe in a Windows host against a file that does not use the standard .dll extension. Investigate the process event logs to determine the name of the file that was registered.

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName == "regsvr32.exe"
| extend match = extract_all(@'regsvr32.*? (?:"(.*?)"|(\S+))', ProcessCommandLine)
| where array_length(match) > 0
| extend RegisteredFileName = coalesce(match[0][0], match[0][1])
| where isnotempty(RegisteredFileName)
| where not(RegisteredFileName endswith ".dll") and not(RegisteredFileName endswith ".ocx")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, RegisteredFileName, ReportId

DeviceProcessEvents | where FileName !endswith '.dll' | extend index = strcat(ProcessId, AccountName) | where ProcessCommandLine has 'regsvr32.exe' | summarize max(TimeGenerated) by index, FileName

DeviceProcessEvents
| where InitiatingProcessFileName =~ 'regsvr32.exe' or InitiatingProcessCommandLine has 'regsvr32.exe'
| extend fileExtension = tostring(split(FileName, '.')[1])
| where FileName !endswith '.dll'
| project DeviceName, FileName, InitiatingProcessCommandLine, TimeGenerated

DeviceProcessEvents
| where FileName =~ "regsvr32.exe"
| where not(ProcessCommandLine has ".dll")
| extend SideloadedFile = extract(@"regsvr32\.exe\s+([^\s]+)", 1, ProcessCommandLine)
| where isnotempty(SideloadedFile) and not(SideloadedFile endswith ".dll")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SideloadedFile

DeviceProcessEvents
| where FileName == 'regsvr32.exe'
| extend filePart = extract(@'[^\\]+$', 0, ProcessCommandLine)  // Extract the last part of the command line, assuming it's the file name
| extend extension = tolower(extract(@'\.([^\.]+)$', 1, filePart))  // Extract and lowercase the file extension
| where extension != 'dll' and isnotnull(extension)  // Filter for files not ending with .dll
| project FileName, ProcessCommandLine, filePart  // Project relevant fields to show the file name

DeviceProcessEvents
| where FileName =~ "regsvr32.exe"
| where isnotempty(ProcessCommandLine)
| where not(ProcessCommandLine has ".dll")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "regsvr32.exe"
| where not(tolower(ProcessCommandLine) has ".dll")
| project TimeGenerated, DeviceName, ProcessCommandLine, FolderPath, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where tolower(ProcessCommandLine) has "regsvr32.exe"
| where not(tolower(ProcessCommandLine) has ".dll")
| extend RegisteredFile = extract("regsvr32\\.exe\\s+(?:/[^\\s]+\\s+)*([^\\s]+)", 1, ProcessCommandLine)
| where isnotempty(RegisteredFile)
| project TimeGenerated, DeviceName, ProcessCommandLine, RegisteredFile

DeviceProcessEvents
| where ProcessCommandLine contains "regsvr32.exe"
| extend SideloadedFile = extract("regsvr32\\.exe\\s+['\"]?([^'\"]+)", 1, ProcessCommandLine)
| where isnotempty(SideloadedFile) and tolower(SideloadedFile) !endswith ".dll"
| project TimeGenerated, DeviceName, ProcessCommandLine, SideloadedFile

DeviceProcessEvents
| where tolower(FileName) == "regsvr32.exe"
| where isnotempty(ProcessCommandLine)
// Extract the arguments string after 'regsvr32.exe'
| parse ProcessCommandLine with * "regsvr32.exe" rest:string
// Split on spaces and take the first token as the target file
| extend args = split(rest, " ")
| extend RegisteredFile = trim('"', tostring(args[0]))
// Filter out switches (starting with '/') and standard .dll targets
| where RegisteredFile !startswith "/"
| where tolower(RegisteredFile) !endswith ".dll"
| project TimeGenerated, DeviceName, AccountName, RegisteredFile, ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where FileName == "regsvr32.exe"
// Extract the first non-switch argument (the target file)
| extend TargetFile = extract(@"(?:regsvr32(?:\.exe)?)(?:\s+/\w+)*\s+([^\s]+)", 1, ProcessCommandLine)
// Only include files that don’t end in .dll
| where isnotempty(TargetFile) and tolower(TargetFile) !endswith ".dll"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, TargetFile
| sort by TimeGenerated desc