Regsvr32 Execution From Potential Suspicious Location
Detects execution of regsvr32.exe where the DLL being registered or unregistered is located in a potentially suspicious directory such as temporary folders or public user directories. This technique is often used by adversaries for defense evasion and to bypass application whitelisting.
Sigma
