Potential Regsvr32 Commandline Flag Anomaly
This rule detects an unusual command-line flag combination for 'regsvr32.exe'. Specifically, it looks for instances where the '/i' flag (install) is used without the '/n' flag (no UI). This combination is often indicative of malicious activity, as legitimate uses of regsvr32.exe with '/i' typically also include '/n' to suppress the user interface.
Sigma
