Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique is often used to bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
Sigma
