Potential Provisioning Registry Key Abuse For Binary Proxy Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique leverages a legitimate Windows binary to proxy the execution of malicious commands, often for defense evasion.