regsvr32-rundll32-abnormal-image-loads

This query is using the locations where malicious DLL images are often loaded from by regsvr32.dll and rundll32.exe. Blog: https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32-exe-rundll32-exe/