Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
Detects potentially suspicious execution of the Regasm or Regsvcs utilities when they are used with command-line arguments containing uncommon file extensions. This behavior can indicate an attempt to bypass application control or execute malicious code through these trusted Windows utilities, often associated with defense evasion techniques.
Sigma
