Rule Info
Name
Scripting/CommandLine Process Spawned Regsvr32
Author
Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Description
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.
Date
2023-05-26 00:00:00
Modified
None
Id
ab37a6ec-6068-432b-a64e-2c7bf95b1d22
Tags
attack.defense_evasion attack.t1218.010 DEMO
Type
Community Rule
Link to Public Repo