Potentially Suspicious Regsvr32 HTTP IP Pattern
Detects `regsvr32.exe` execution attempting to download and install DLLs from a remote IP address. This technique is often used for defense evasion and bypassing application control by leveraging a trusted Microsoft binary to execute arbitrary code.
Sigma
