Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1218.010_regsvr32
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
Passed 21 of 23 test cases with the skill, and 15 of 23 without it.
and 4 more in the full report
7 fixed16 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
According to enterprise security frameworks, which MITRE ATT&CK mitigation ID addresses preventing or blocking regsvr32.exe application control bypasses through tools like Windows Defender Application Control or AppLocker?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies the mitigation ID as M1050 | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1218
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.
Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Regsvr32.exe is a command-line program used to register and unregister OLE controls. Upon execution, calc.exe will be launched.
Supported Platforms: windows
#{regsvr32path}\#{regsvr32name} /s /u /i:"#{filename}" scrobj.dll
test cases passed, vs 15 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.