Skip to content

Hide Navigation Hide TOC

Potentially Suspicious Child Process Of Regsvr32 (6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca)

Detects potentially suspicious child processes of "regsvr32.exe".

Cluster A Galaxy A Cluster B Galaxy B Level
Potentially Suspicious Child Process Of Regsvr32 (6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca) Sigma-Rules Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab) Attack Pattern 1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab) Attack Pattern 2