Suspicious Execution Chain with System Binaries

Vidhi Patel@V1d

•updated Apr 7, 2026•29•0•329

Detects suspicious process execution chains involving 'regsvr32.exe' followed by 'mshta.exe', 'powershell.exe', or 'rundll32.exe', especially when 'regsvr32.exe' is launched from common user download or application data directories. This pattern is often indicative of malware execution or living-off-the-land techniques.