DNS Query Request By Regsvr32.EXE
Detects DNS queries initiated by 'Regsvr32.exe'. This activity is suspicious as 'Regsvr32.exe' is a legitimate Windows utility used to register and unregister DLLs, but it is often abused by adversaries for proxy execution, defense evasion, and bypassing application control. A DNS query from this process could indicate an attempt to resolve a malicious domain for command and control or payload retrieval.
Sigma
