| elastic |
Suspicious MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
Network Connection via Registration Utility |
production |
2026-09-18 |
| elastic |
Execution of Persistent Suspicious Program |
production |
2026-09-18 |
| elastic |
Delayed Execution via Ping |
production |
2026-09-18 |
| elastic |
Execution from Unusual Directory - Command Line |
production |
2026-09-18 |
| elastic |
Suspicious MS Outlook Child Process |
production |
2026-09-18 |
| splunk |
Detect Regsvcs with Network Connection |
production |
2026-05-13 |
| splunk |
Detect Regasm Spawning a Process |
production |
2026-05-13 |
| splunk |
Detect Regasm with Network Connection |
production |
2026-05-13 |
| splunk |
Detect Regasm with no Command Line Arguments |
production |
2026-05-13 |
| splunk |
Detect Regsvcs Spawning a Process |
production |
2026-05-13 |
| splunk |
Detect Regsvcs with No Command Line Arguments |
production |
2026-05-13 |
| sigma |
RegAsm.EXE Execution Without CommandLine Flags or Files |
experimental |
2025-06-04 |
| sigma |
RegAsm.EXE Initiating Network Connection To Public IP |
test |
2024-04-25 |
| sigma |
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location |
test |
2023-02-13 |
| sigma |
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension |
test |
2023-02-13 |
| elastic |
Execution via Regsvcs/Regasm |
deprecated |
2021-03-17 |