Regsvr32 Squiblydoo Remote COM Scriptlet Execution (T1218.010)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the use of regsvr32.exe with the /s (silent) and /u (unregister) flags to execute a remote scriptlet file (e.g., .sct, scrobj.dll) via HTTP, a common technique for proxy execution and bypassing application control mechanisms.