Regsvr32 Execution with Suspicious Parameters
Detects execution of regsvr32.exe with command line arguments indicating potential exploitation using remote scripts or controls.
Microsoft Sentinel (KQL)

Detects execution of regsvr32.exe with command line arguments indicating potential exploitation using remote scripts or controls.

Already have an account?