Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".