t1218-010-regsvr32

name	T1218.010_regsvr32
description	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1218.010","defense-evasion","windows","sub-technique"]
technique_id	T1218.010
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1218/010
tech_stack	["windows"]
cwe_ids	["CWE-693"]
chains_with	["T1218","T1218.001","T1218.002","T1218.003","T1218.004","T1218.005","T1218.007","T1218.008","T1218.009","T1218.011","T1218.012","T1218.013","T1218.014","T1218.015"]
prerequisites	["T1218"]
severity_boost	{"T1218":"Chain with T1218 for deeper attack path","T1218.001":"Chain with T1218.001 for deeper attack path","T1218.002":"Chain with T1218.002 for deeper attack path"}

T1218.010 Regsvr32

Sub-technique of: T1218

High-Level Description

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.

Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.

Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows

What to Check

• Identify if Regsvr32 technique is applicable to target environment
• Check Windows systems for indicators of Regsvr32
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Regsvr32 local COM scriptlet execution

Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.

Supported Platforms: windows

#{regsvr32path}\#{regsvr32name} /s /u /i:"#{filename}" scrobj.dll

Dependencies:

• Regsvr32.sct must exist on disk at specified location (#{filename})

Atomic Test 2: Regsvr32 remote COM scriptlet execution