Skip to content
Threat Feed

Actor

Remcos

1 brief RSS
high threat

Regsvr32 Silent and Install Parameter DLL Loading

Detection of regsvr32.exe being used with the silent and DLL install parameter to load a DLL, a technique used by RATs like Remcos and njRAT to execute arbitrary code.

Splunk Enterprise +2 Remcos +1 lolbin dll-loading regsvr32
2r 2t