Most Important LOLBAS Detection 2026: Regasm.exe and Regsvcs.exe COM Registratio
Detects the execution of regasm.exe or regsvcs.exe where the command line arguments reference paths typically used for temporary files, user downloads, or public directories. These signed .NET utilities can be abused to proxy the execution of malicious code by loading custom COM assemblies via ComRegisterFunction or ComUnregisterFunction attributes, effectively bypassing application control.
Microsoft Sentinel (KQL)
