t1218.009 | LoFP

t1218.009

Title	Tags
although unlikely, limited instances of regasm.exe or may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk
although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk
although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk
although unlikely, limited instances of regsvcs.exe may cause a false positive. filter based endpoint usage, command line arguments, or process lineage.	t1218 t1218.009 endpoint splunk