Regsvr32 DLL Execution With Suspicious File Extension

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•0•14

Detects the execution of Regsvr32.exe with DLL files that have been renamed or masqueraded with suspicious file extensions. This technique is often used by adversaries for defense evasion and to bypass application control by proxying execution through a legitimate Windows binary.