Squiblydoo Regsvr32 Remote Scriptlet Execution (T1218.010)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the execution of regsvr32.exe with command-line arguments that attempt to load and execute a remote scriptlet (SCT file) via a URL. This technique is often used to bypass application control and proxy the execution of arbitrary code using the trusted regsvr32.exe binary.