LOLBin proxy execution via regsvr32/mshta/certutil/rundll32
Detects the abuse of common Windows LOLBins (Living Off the Land Binaries) like regsvr32, mshta, certutil, and rundll32 to proxy the execution of remote scripts, DLLs, or malicious payloads, a technique often used to bypass security controls.
Splunk (SPL)
