INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
rundll32.exe ieadvpack.dll,RegisterOCX calc.exe
Launch an executable by calling the RegisterOCX function.
Run an executable payload.
c:\windows\system32\ieadvpack.dll, c:\windows\syswow64\ieadvpack.dll
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml, Splunk: https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
Jimmy (LaunchINFSection) (@bohops), Fabrizio (RegisterOCX - DLL) (@0rbz_), Pierre-Alexandre Braeken (RegisterOCX - CMD) (@pabraeken)