REGISTER_APP.VBS Proxy Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. This technique can be used by adversaries for defense evasion by proxying execution of malicious content with a trusted binary.