Regsvr32 or CMSTP Network Connection to External IP
Detects network connections initiated by regsvr32.exe or cmstp.exe to external IP addresses on common web ports. This behavior can indicate the use of these legitimate Windows utilities for malicious purposes, such as downloading and executing malicious scripts or DLLs, often bypassing application whitelisting.
Splunk (SPL)
