Suspicious Execution of Regasm/Regsvcs from Uncommon Location
This rule detects the execution of Regasm.exe or Regsvcs.exe from suspicious directories. Adversaries often abuse these legitimate Windows utilities to proxy execution of malicious code, particularly for defense evasion. By monitoring their execution from uncommon locations like temporary folders or user-writable directories, this rule aims to identify potential malicious activity that leverages these binaries for purposes such as bypassing application control or achieving persistence.
Sigma
