Regsvr32 Network Download of Scriptlet

nomit vyas@xoxo

•updated Apr 30, 2026•6•0•86

Detects regsvr32.exe executing with command-line arguments that indicate an attempt to download and execute a scriptlet from a remote HTTP/HTTPS source. This technique, often referred to as 'Squiblydoo', is used to bypass application control and execute malicious code.