Regsvr32 AppLocker Bypass - LOTL Execution

Georg Lauenstein@gsec

•updated Mar 7, 2026•2•0•40

Detects regsvr32.exe with scrobj.dll loading remote scriptlets to bypass application whitelisting