Regsvr32 Execution with Remote HTTP/FTP DLL Load

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the execution of regsvr32.exe with command-line arguments that indicate an attempt to download or register DLLs from remote HTTP or FTP servers. This technique is often used for defense evasion and to bypass application whitelisting by leveraging a legitimate Windows binary to execute malicious code.