Scripting/CommandLine Process Spawned Regsvr32

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.