Msiexec.exe DllUnregisterServer Function Call
This rule detects the execution of msiexec.exe attempting to load a DLL and call its DllUnregisterServer function. This behavior is often abused by adversaries for defense evasion and proxy execution, as msiexec.exe is a legitimate Windows utility. The detection specifically looks for msiexec.exe being executed with the '-z' flag and a command line containing '.dll', indicating an attempt to unregister a DLL.
Sigma
