Regsvr32 DLL Execution With Uncommon Extension

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

Detects the execution of 'regsvr32.exe' attempting to load a DLL with an uncommon or unrecognized file extension. This behavior is often associated with defense evasion techniques where adversaries use legitimate Windows binaries to proxy execution of malicious code, bypassing application whitelisting or other security controls.