Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows IOBit Unlocker Extension DLL Registration via Regsvr32

Detects the IOBit Unlocker Extension being registered. IObit Unlocker is a utility designed to resolve issues involving files or folders that cannot be deleted, moved, or renamed due to being locked by other…

Description

Detects the IOBit Unlocker Extension being registered. IObit Unlocker is a utility designed to resolve issues involving files or folders that cannot be deleted, moved, or renamed due to being locked by other processes or applications in Windows. It's a powerful tool that can "unlock" these files or folders, terminating any processes that are using them. This allows users to manipulate these previously inaccessible files or folders as needed.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Some legitimate users may run IObit Unlocker to manage locked files for maintenance or troubleshooting. Filter detections for approved use to reduce false alerts.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice