Regsvr32 DLL Execution With Uncommon Extension — Detection Rule

Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Read the full analysis on IntelFusions