Applied Cybernetics Group
T1218.010 Regsvr32
- Technique
T1218.010- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 19
- Elastic, Splunk
- 22
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1218/010
MITRE description
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.(Citation: Microsoft Regsvr32) Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed.(Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.(Citation: Carbon Black Squiblydoo Apr 2016)(Citation: FireEye Regsvr32 Targeting Mongolian Gov) Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015).(Citation: Carbon Black Squiblydoo Apr 2016)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-30Darktrace: CikaBika Bot: Inside a Discord RAT Campaign
Detection coverage
SigmaHQ community rules
- Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32 (emerging-threats)
- Potential EmpireMonkey Activity (emerging-threats)
- DNS Query Request By Regsvr32.EXE (core)
- Unsigned DLL Loaded by Windows Utility (core)
- Network Connection Initiated By Regsvr32.EXE (core)
- HTML Help HH.EXE Suspicious Child Process (core)
- Suspicious HH.EXE Execution (core)
- Suspicious Microsoft Office Child Process (core)
- Potential Regsvr32 Commandline Flag Anomaly (core)
- Potentially Suspicious Regsvr32 HTTP IP Pattern (core)
- Potentially Suspicious Regsvr32 HTTP/FTP Pattern (core)
- Suspicious Regsvr32 Execution From Remote Share (core)
- Potentially Suspicious Child Process Of Regsvr32 (core)
- Regsvr32 Execution From Potential Suspicious Location (core)
- Regsvr32 Execution From Highly Suspicious Location (core)
- Regsvr32 DLL Execution With Suspicious File Extension (core)
- Scripting/CommandLine Process Spawned Regsvr32 (core)
- Suspicious WMIC Execution Via Office Process (core)
- Suspicious WmiPrvSE Child Process (core)
Elastic and Splunk rules
- Potential Command and Control via Internet Explorer (elastic)
- Suspicious .NET Code Compilation (elastic)
- Unusual Network Activity from a Windows System Binary (elastic)
- Suspicious Execution from a Mounted Device (elastic)
- Suspicious Managed Code Hosting Process (elastic)
- Suspicious Script Object Execution (elastic)
- Delayed Execution via Ping (elastic)
- Execution from Unusual Directory - Command Line (elastic)
- Network Connection via Registration Utility (elastic)
- Suspicious PDF Reader Child Process (elastic)
- Suspicious Windows Command Shell Arguments (elastic)
- Suspicious JetBrains TeamCity Child Process (elastic)
- Suspicious MS Office Child Process (elastic)
- Suspicious MS Outlook Child Process (elastic)
- Suspicious Explorer Child Process (elastic)
- Execution of Persistent Suspicious Program (elastic)
- Service Control Spawned via Script Interpreter (elastic)
- Detect Regsvr32 Application Control Bypass (splunk)
- Malicious InProcServer32 Modification (splunk)
- Regsvr32 Silent and Install Param Dll Loading (splunk)
- Suspicious Regsvr32 Register Suspicious Path (splunk)
- Windows IOBit Unlocker Extension DLL Registration via Regsvr32 (splunk)