Regasm/Regsvcs Signed Binary Proxy Execution HTTP Activity - T1218.009

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects HTTP traffic where the User-Agent header references Regasm or Regsvcs, which are trusted Windows utilities often abused by attackers to proxy execution of malicious code (Living-off-the-Land Binary technique).