APT28 - Regsvr32 LOLBin Execution with Remote Payload

Chaitanya B B@mralien

•updated Jul 4, 2025•3•4•23

Detects use of regsvr32.exe to load remote script/control objects from suspicious URLs, a technique used by APT28 and others.