Getting Data In

regsvr32 logging

tkoster8
New Member

I'm trying to figure out how to log whenever regsvr32 is called to register or unregister a dll. I know its possible to pull the events using something like sysmon but I'm trying to figure out if there is another setting that I'm missing or a splunk app out there that can pull it without having to install yet another agent on a system.

Tags (2)
0 Karma
1 Solution

nickhills
Ultra Champion

Enable process creation auditing (event 4688) in your group/security policy AND enable command line auditing (checkbox)

This will show all invocations of regsvr32 and any command line arguments sent to it.

https://www.itprotoday.com/strategy/understanding-and-enabling-command-line-auditing

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Enable process creation auditing (event 4688) in your group/security policy AND enable command line auditing (checkbox)

This will show all invocations of regsvr32 and any command line arguments sent to it.

https://www.itprotoday.com/strategy/understanding-and-enabling-command-line-auditing

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...