Detect Regsvcs/Regasm in Google Chronicle

rule regsvcs_regasm_proxy_execution {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1218.009 - Regsvcs/Regasm proxy execution abuse. Identifies regsvcs.exe or regasm.exe launched from suspicious parent processes, with suspicious arguments, from non-standard paths, or spawning suspicious child processes."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1218.009"
    severity = "HIGH"
    confidence = "HIGH"
    rule_version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.metadata.product_name = "Microsoft-Windows-Sysmon" or $e.metadata.product_name = "Microsoft Defender for Endpoint"
    (
      re.regex($e.target.process.file.full_path, `(?i)(\\regsvcs\.exe|\\regasm\.exe)$`) or
      re.regex($e.principal.process.file.full_path, `(?i)(\\regsvcs\.exe|\\regasm\.exe)$`)
    )
    (
      re.regex($e.target.process.command_line, `(?i)(Temp|AppData|Downloads|Public|Desktop|ProgramData)`) or
      re.regex($e.target.process.command_line, `(?i)(\/u|\/unregister|\/silent|\/s)\b`) or
      re.regex($e.target.process.command_line, `(?i)(http:\/\/|https:\/\/|\\\\\\\\)`) or
      re.regex($e.principal.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta|winword|excel)\.exe$`) or
      (
        re.regex($e.principal.process.file.full_path, `(?i)(\\regsvcs\.exe|\\regasm\.exe)$`) and
        re.regex($e.target.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|net|rundll32)\.exe$`)
      )
    )

  condition:
    $e
}