Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly

Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location. When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.

Sigma