Network Connection Initiated By Regsvr32.EXE
Detects when the Windows utility 'Regsvr32.exe' initiates an outbound network connection. This behavior can indicate an attempt to bypass application control or execute malicious code by loading remote COM scriptlets or DLLs, often referred to as 'Squiblydoo'.
Sigma
