REGISTER_APP.VBS Proxy Execution (1c8774a0-44d4-4db0-91f8-e792359c70bd)
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| REGISTER_APP.VBS Proxy Execution (1c8774a0-44d4-4db0-91f8-e792359c70bd) | Sigma-Rules | System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) | Attack Pattern | 1 |