regsvr32 logging

[tkoster8]

I'm trying to figure out how to log whenever regsvr32 is called to register or unregister a dll. I know its possible to pull the events using something like sysmon but I'm trying to figure out if there is another setting that I'm missing or a splunk app out there that can pull it without having to install yet another agent on a system.

[nickhills · Accepted solution]

Enable process creation auditing (event 4688) in your group/security policy AND enable command line auditing (checkbox)

This will show all invocations of regsvr32 and any command line arguments sent to it.

https://www.itprotoday.com/strategy/understanding-and-enabling-command-line-auditing