COM Object Execution via Xwizard.EXE
Detects the execution of Xwizard.EXE with the "RunWizard" flag and a GUID-like argument, which indicates an attempt to abuse this utility to run custom COM objects created in the registry. This technique is often used for defense evasion.
Sigma
