Potentially Suspicious Regsvr32 HTTP/FTP Pattern (867356ee-9352-41c9-a8f2-1be690d78216)

Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab)	Attack Pattern	Potentially Suspicious Regsvr32 HTTP/FTP Pattern (867356ee-9352-41c9-a8f2-1be690d78216)	Sigma-Rules	1
Regsvr32 - T1218.010 (b97f1d35-4249-4486-a6b5-ee60ccf24fab)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2