Regsvr32 Execution From Highly Suspicious Location
This rule detects the execution of `regsvr32.exe` when the DLL it attempts to register or unregister is located in highly suspicious directories. These directories are typically not used for legitimate `regsvr32` operations and can indicate an attempt to evade defenses or execute malicious code from an unusual location. The rule specifically looks for `regsvr32.exe` being executed with a command line that includes paths such as `PerfLogs`, `Temp`, various `Windows\System32` subdirectories not commonly used for DLL registration, and `Windows\SysWOW64` subdirectories, while excluding common legitimate program and system directories.
Sigma
