Regsvr32 with Scriptlet or Remote/User-Writable Resource (InstallFix)
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Microsoft Sentinel (KQL)
