Getting Data In

regsvr32 logging

New Member

I'm trying to figure out how to log whenever regsvr32 is called to register or unregister a dll. I know its possible to pull the events using something like sysmon but I'm trying to figure out if there is another setting that I'm missing or a splunk app out there that can pull it without having to install yet another agent on a system.

Tags (2)
0 Karma
1 Solution

Ultra Champion

Enable process creation auditing (event 4688) in your group/security policy AND enable command line auditing (checkbox)

This will show all invocations of regsvr32 and any command line arguments sent to it.

https://www.itprotoday.com/strategy/understanding-and-enabling-command-line-auditing

View solution in original post

0 Karma

Ultra Champion

Enable process creation auditing (event 4688) in your group/security policy AND enable command line auditing (checkbox)

This will show all invocations of regsvr32 and any command line arguments sent to it.

https://www.itprotoday.com/strategy/understanding-and-enabling-command-line-auditing

View solution in original post

0 Karma