Kazuar Dropper Registers a Lightweight COM Loader
Detects registration or activation of a .NET COM object from a writable path before an in-memory payload is supplied. This rule specifically looks for command-line arguments containing COM-related keywords (regasm, regsvcs, comvisible, clsid, inprocserver32) in conjunction with common writable user-controlled directories (appdata, programdata, temp, users\public).
Splunk (SPL)
