Skip to content

[BUG] Typo in windows_alternate_datastream___process_execution.yml - regscr32.exe should be regsvr32.exe #4076

Closed
Bug
#4117
Closed
[BUG] Typo in windows_alternate_datastream___process_execution.yml - regscr32.exe should be regsvr32.exe#4076
Bug
#4117
Assignees
nasbench
Labels
bugSomething isn't working

Description

@aowen-nci
aowen-nci
opened on May 8, 2026

Describe the bug

regscr32.exe should be regsvr32.exe

Expected behavior

lolbin is regsvr32.exe

App Version:

  • Splunk Security Essentials

Additional context

URL: https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_alternate_datastream___process_execution.yml

Activity

  1. aowen-nci
    added the
    Bug
    issue type on May 8, 2026
  2. aowen-nci
    added
    bugSomething isn't working
    on May 8, 2026
  3. nasbench
    self-assigned this
    on May 11, 2026
  4. nasbench
    linked a pull request that will close this issueFix regsvr32 typo in ADS process detection #4117on Jun 14, 2026
  5. nasbench
    closed this as completedon Jun 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Bug

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions