Windows Server Software Component GACUtil Install to GAC
The analytic detects the use of GACUtil.exe to add a DLL into the Global Assembly Cache (GAC). This activity is significant because adding a DLL to the GAC allows it to be called by any application, potentially enabling widespread code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code across the operating system, leading to privilege escalation or persistent access.
Splunk (SPL)
