https://community.splunk.com/t5/Getting-Data-In/regsvr32-logging/m-p/427635#M74930 <P>I'm trying to figure out how to log whenever regsvr32 is called to register or unregister a dll. I know its possible to pull the events using something like sysmon but I'm trying to figure out if there is another setting that I'm missing or a splunk app out there that can pull it without having to install yet another agent on a system. </P> Mon, 11 Mar 2019 15:18:25 GMT tkoster8 2019-03-11T15:18:25Z https://community.splunk.com/t5/Getting-Data-In/regsvr32-logging/m-p/427635#M74930 <P>I'm trying to figure out how to log whenever regsvr32 is called to register or unregister a dll. I know its possible to pull the events using something like sysmon but I'm trying to figure out if there is another setting that I'm missing or a splunk app out there that can pull it without having to install yet another agent on a system. </P> Mon, 11 Mar 2019 15:18:25 GMT https://community.splunk.com/t5/Getting-Data-In/regsvr32-logging/m-p/427635#M74930 tkoster8 2019-03-11T15:18:25Z https://community.splunk.com/t5/Getting-Data-In/regsvr32-logging/m-p/427636#M74931 <P>Enable process creation auditing (event 4688) in your group/security policy AND enable command line auditing (checkbox)</P> <P>This will show all invocations of regsvr32 and any command line arguments sent to it. </P> <P><A href="https://www.itprotoday.com/strategy/understanding-and-enabling-command-line-auditing">https://www.itprotoday.com/strategy/understanding-and-enabling-command-line-auditing</A></P> Mon, 11 Mar 2019 17:40:13 GMT https://community.splunk.com/t5/Getting-Data-In/regsvr32-logging/m-p/427636#M74931 nickhills 2019-03-11T17:40:13Z