T1218.010 — Regsvr32

Tactic: Stealth · Platforms: Windows

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.010 System Binary Proxy Execution: Regsvr32

title: "T1218.010 System Binary Proxy Execution: Regsvr32"
id: d87d0db2-c3db-4598-8d89-eb0932a8f278
description: 'Detection Strategy for System Binary Proxy Execution: Regsvr32. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: AllowedDLLPaths, ScriptletExtensions, TimeWindow, ParentProcessWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1218/010
author: Shahrukh Khan
date: 2026-03-17
license: MIT
tags:
  - attack.stealth
  - attack.t1218.010

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains:
      - 'scrobj.dll'
      - '/i:http'

  condition: selection

falsepositives:
  - Almost never legitimate — the Squiblydoo pattern (regsvr32 loading a remote .sct scriptlet) has essentially no benign use case.

level: critical

Related sub-techniques

Explore