Regsvr32 Squiblydoo - Remote Scriptlet Execution via scrobj.dll

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•4

This rule detects the use of Regsvr32.exe to execute remote scriptlets (.sct files) from external HTTP/HTTPS URLs by loading the scrobj.dll module. This technique, commonly known as 'Squiblydoo', is used to bypass application allowlisting (such as AppLocker) and proxy execution of malicious code.