DLL Execution Via Register-cimprovider.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects the execution of 'register-cimprovider.exe' with command-line arguments indicating an attempt to register a DLL. This technique can be used by adversaries to achieve persistence, privilege escalation, or defense evasion by loading malicious DLLs through a legitimate Windows binary.