Skip to content

Hide Navigation Hide TOC

Regsvr32 Execution From Highly Suspicious Location (327ff235-94eb-4f06-b9de-aaee571324be)

Detects execution of regsvr32 where the DLL is located in a highly suspicious locations

Cluster A Galaxy A Cluster B Galaxy B Level
Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab) Attack Pattern Regsvr32 Execution From Highly Suspicious Location (327ff235-94eb-4f06-b9de-aaee571324be) Sigma-Rules 1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab) Attack Pattern 2