RegAsm.EXE Execution Without Command-Line Arguments
Detects the execution of "RegAsm.exe" without any command-line flags or specified files. This behavior is unusual for legitimate use of RegAsm.exe, which typically registers .NET assemblies or displays help information. Such execution patterns can indicate an attempt at process injection or other forms of defense evasion by adversaries abusing a trusted Windows utility.
Sigma
