Automation · API / MCP 中文

Technique note · T1117

Regsvr32

Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of whitelists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe is also a Microsoft signed binary. Regsvr32.exe can also be used to specifically bypass process whitelisting using functionality to load COM scriptlets to execute DLLs under user permissions. Since regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. Regsvr32.exe can also be leveraged to register a COM Object used to establish Persistence via Component Object Model Hijacking.

ATT&CK T1117 platforms — Status Active Version 20.1

Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. 1 Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of whitelists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe is also a Microsoft signed binary. Regsvr32.exe can also be used to specifically bypass process whitelisting using functionality to load COM scriptlets to execute DLLs under user permissions. Since regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. 2 This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. 3 4 Regsvr32.exe can also be leveraged to register a COM Object used to establish Persistence via Component Object Model Hijacking. 5

  1. Microsoft Regsvr32
  2. LOLBAS Regsvr32
  3. Carbon Black Squiblydoo Apr 2016
  4. FireEye Regsvr32 Targeting Mongolian Gov
  5. Carbon Black Squiblydoo Apr 2016

Groups using this technique

No group use in the reference set yet.

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.