RegAsm.EXE Initiating Network Connection To Public IP
Detects the 'RegAsm.exe' utility initiating an outbound network connection to a public IP address. RegAsm.exe is a legitimate Microsoft utility used to register .NET assemblies, but it can be abused by adversaries for defense evasion and proxy execution, especially when making unexpected network connections.
Sigma
