Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG (7021255e-5db3-4946-a8b9-0ba7a4644a69)

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG (7021255e-5db3-4946-a8b9-0ba7a4644a69)	Sigma-Rules	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	1