regsvcs.exe

regsvcs.exe installs a .NET assembly into COM+ Component Services and registers it. As with regasm.exe, an assembly can include methods that run during registration, so pointing regsvcs at an assembly executes that code. It ships with the .NET Framework, so the genuine binary lives under C:\Windows\Microsoft.NET\Framework and Framework64, not System32.

Legitimately, regsvcs is run by developers and installers deploying COM+ serviced components, which is uncommon on ordinary machines. The assembly it registers and its origin are what give an instance meaning.

regsvcs.exe is a system-binary proxy (T1218.009), paired with regasm.exe under the same ATT&CK sub-technique. Because the registration of a serviced component runs code in the target assembly, an attacker ships an assembly with the payload in that code and has the signed Microsoft tool execute it, bypassing application-control rules that trust Microsoft binaries and keeping the payload in a DLL.

Since COM+ component installation is rare on most hosts, regsvcs running at all is already worth a look, and an assembly from a temp or download folder, or a parent like an Office application, confirms it.