Regsvr32 COM Scriptlet Remote Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to leverage Regsvr32 for COM scriptlet remote execution. It specifically looks for HTTP traffic where the URI contains '.sct' (indicating a scriptlet file) and the file data contains XML content with the word 'registration', which are common characteristics of COM scriptlets used in Regsvr32 attacks.