Background

We looked for a fresh news item from the past 48 hours to anchor this guide. A WebSearch on 28 October 2026 returned nothing dated 27 or 28 October (the newest results were from July and August 2026), so this is an evergreen technique guide. No evidence found as of 28 October 2026 in that search of a new regsvr32-specific campaign; that is a limit of our search, not a statement about the threat landscape.

Regsvr32.exe is a signed Windows binary that registers and unregisters COM components. Per the MITRE ATT&CK page for T1218.010 (which we opened), adversaries use it to proxy execution of malicious code, load COM scriptlets, run DLLs under user permissions, and fetch scripts from remote URLs. The remote scriptlet variant is called “Squiblydoo”. MITRE credits Casey Smith as contributor, lists the page as version 3.0, created 23 January 2020 and last modified 12 May 2026. ATT&CK labels the tactic “Stealth” on that page.

What ATT&CK reports

MITRE lists many groups and tools as using the technique, including APT32, Kimsuky, Lazarus Group (Operation Dream Job), Storm-0501, TA551, QakBot, Emotet, Raspberry Robin and Koadic. This is a single-source summary of MITRE’s procedure examples; we did not open the underlying reports for each one.

MITRE’s detection strategy (DET0282, analytic AN0785) points to these signals:

  • Scriptlets or DLLs loaded from temporary directories or remote URLs.
  • /i or /u arguments paired with suspicious file references.
  • Outbound network connections initiated by regsvr32.exe.
  • Unsigned or untrusted DLLs loaded shortly after regsvr32 runs.

MITRE’s listed mitigation is Attack Surface Reduction rules plus application control (WDAC, AppLocker or Software Restriction Policies).

Detection 1: the /i flag without /n (Sigma)

SigmaHQ publishes a rule, “Potential Regsvr32 Commandline Flag Anomaly” (id b236190c-1c61-41e9-84b3-3fe03f6d76b0, author Florian Roth, status test, last modified 2024-03-13 in the copy we fetched from raw.githubusercontent.com). It flags the /i flag used without /n, which is uncommon. We reproduce its logic below in our own wording. We did not run it.

title: Regsvr32 Install Flag Without No-Install Flag (paraphrase of SigmaHQ logic)
status: experimental
description: Untested. Regsvr32 with -i:/ /i: but without -n.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains|windash: ' -i:'
  filter_main_flag:
    CommandLine|contains|windash: ' -n '
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrator typos
  - Installers that legitimately pass an install argument
level: medium
tags:
  - attack.t1218.010

Our assessment: this rule keys on a flag pattern, so an attacker who adds /n or reorders arguments avoids it. Treat it as one layer.

Detection 2: regsvr32 with a URL or scriptlet argument (KQL)

Untested. Written by us from the MITRE indicators above, not validated against production data. Tune the path and extension lists to your estate.

DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName =~ "regsvr32.exe"
| where ProcessCommandLine matches regex @"(?i)https?://"
    or ProcessCommandLine has_any ("scrobj.dll", ".sct", @"\AppData\", @"\Temp\", @"\Users\Public\")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Expected noise: software installers, and some line-of-business tools that register DLLs from temp folders during setup. Baseline first.

Detection 3: regsvr32 making network connections (KQL)

Untested. This follows the MITRE indicator “outbound network connections initiated by regsvr32.exe”.

DeviceNetworkEvents
| where Timestamp > ago(14d)
| where InitiatingProcessFileName =~ "regsvr32.exe"
| where RemoteIPType == "Public"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort

Regsvr32 reaching a public address is rare in most environments, so even a small hit count is worth triage. Our assessment, not sourced: this is likely the highest-signal of the three because it holds regardless of how the command line is obfuscated.

Triage and response

  1. Capture the full command line and parent process. Office, script hosts or a browser as parent raises priority.
  2. Retrieve the scriptlet or DLL if the URL is still live, and detonate it in isolation.
  3. Check module loads of scrobj.dll in the regsvr32 process (Sysmon event 7 or DeviceImageLoadEvents).
  4. Scope the account and host for follow-on activity.

Hardening: enable the relevant ASR rules and deploy WDAC or AppLocker as MITRE recommends. Validate in audit mode first.

Sources and gaps

Opened: MITRE ATT&CK T1218.010 (https://attack.mitre.org/techniques/T1218/010/); SigmaHQ raw rule file for regsvr32 flag anomaly. Search attempted: WebSearch for news on 28 October 2026, which returned nothing recent. Not opened: the individual threat reports behind MITRE’s procedure examples, Microsoft ASR documentation, and the original Casey Smith research. No IOCs are given because we have none from a verified source. None of our queries were tested against live telemetry.