Lolbin Unregmp2.exe Use As Proxy

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•13

Detects the usage of the 'unregmp2.exe' binary as a proxy to launch a custom version of 'wmpnscfg.exe' by looking for the '/HideWMP' command-line argument. This technique is often used for defense evasion.