Potentially Suspicious Regsvr32 HTTP/FTP Pattern

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.