Abuse of Regsvr32 for Application Control Bypass

Regsvr32.exe is a command-line utility used to register and unregister OLE controls, such as DLLs, in the Windows Registry. Because it is a signed, trusted Microsoft binary, it is frequently abused by threat actors to proxy the execution of arbitrary malicious code, effectively bypassing application control mechanisms such as AppLocker or Windows Defender Application Control (WDAC). This technique, often referred to as "Squiblydoo," involves using Regsvr32.exe to load a remote or local script file via the "scrobj.dll" component. By executing scripts through this legitimate binary, attackers can achieve code execution and establish persistent access while remaining hidden from signature-based security controls. This activity has been observed in various campaigns, including ransomware operations and Cobalt Strike deployments. Defenders must monitor process creation and command-line arguments to detect the loading of scrobj.dll by regsvr32.exe, as this is a high-fidelity indicator of malicious intent.

Attack Chain

1. Attacker gains initial access to the Windows host through a spearphishing email or exploitation of a service.
2. Attacker writes a malicious script (.sct file) to a local directory or identifies a remote URL hosting the script.
3. Attacker executes regsvr32.exe from a command prompt or terminal.
4. The regsvr32.exe process is invoked with command-line arguments specifying the "/s" (silent) flag.
5. The attacker includes the "/i" flag followed by the path or URL of the malicious .sct file.
6. regsvr32.exe loads scrobj.dll to parse and execute the script content within the context of the trusted process.
7. The malicious script executes its payload, such as a shellcode stager or backdoor.
8. The attacker achieves code execution, persistence, or begins lateral movement within the environment.

Impact

Successful exploitation of this technique allows attackers to bypass application control policies, enabling the execution of unauthorized or malicious code. This can lead to full system compromise, exfiltration of sensitive data, deployment of ransomware, or the establishment of long-term persistence in the target environment. The use of a trusted system binary makes this activity difficult to detect without specific telemetry focused on process behavior and command-line arguments.

Recommendation

1. Deploy the Sigma rules below to your SIEM to monitor for suspicious invocations of regsvr32.exe.
2. Ensure that process creation events (specifically Sysmon Event ID 1) are being ingested and that command-line arguments are captured in full.
3. Implement AppLocker or WDAC policies that explicitly restrict the execution of untrusted scripts or the use of Regsvr32 in a manner consistent with script loading.
4. Use the provided process creation telemetry to alert on regsvr32.exe command lines containing "scrobj.dll" or ".sct" files.