Checks for an autostart that is attempting to load a dynamic link library (DLL) from the internet.
Use the policy below to verify
SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM startup_items WHERE path = "regsvr32" AND args LIKE "%http%");
Share