Suspicious Regsvr32 Execution From Remote Share

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of `regsvr32.exe` to load a DLL hosted on a remote network share. This technique is often used by adversaries for defense evasion and to bypass application control.