Regsvr32 Execution with Suspicious Parameters
Detects the execution of regsvr32.exe with suspicious command-line parameters, often used by adversaries to execute malicious code (e.g., scripts, DLLs) from remote locations or local script files. This technique is a common LOLBAS method for proxy execution.
Sigma
