regasm.exe

regasm.exe reads a .NET assembly and writes the registry entries that let COM applications create and call its types. The detail that matters is that an assembly can define methods that run during registration and unregistration, so pointing regasm at an assembly executes that code. It ships with the .NET Framework, so the genuine binary lives under C:\Windows\Microsoft.NET\Framework and Framework64, not System32.

Legitimately, regasm is run by developers and installers to make managed components available to COM. The assembly it registers and where that assembly came from are what give an instance meaning.

regasm.exe is a system-binary proxy (T1218.009). Because an assembly can carry code in its registration and unregistration functions, an attacker builds an assembly with the payload there and runs regasm /u evil.dll (or the register path) so the signed Microsoft tool executes it. The closely related regsvcs.exe abuses the same .NET registration callbacks. Both bypass application-control rules that trust Microsoft binaries and keep the payload inside a DLL.

Because the binary and the registration are legitimate, what to read is the context: the assembly path, the parent, and whether the host does any development. An assembly run from a temp or download folder, or regasm launched by an Office process, is the case to examine.