Potentially Suspicious Child Process Of Regsvr32
This rule detects the creation of potentially suspicious child processes by 'regsvr32.exe'. Regsvr32.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious code, often referred to as 'Squiblydoo'. The rule specifically looks for regsvr32.exe spawning common Windows utilities or scripting engines like calc.exe, powershell.exe, cmd.exe (implied by net.exe, net1.exe, reg.exe, schtasks.exe), mshta.exe, cscript.exe, and wscript.exe. This behavior is often indicative of defense evasion or execution techniques where regsvr32.exe is used to bypass application whitelisting or security controls.
Sigma
