Squiblydoo Regsvr32 COM Scriptlet Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects the download of a COM scriptlet (.sct file) over HTTP that contains XML and the keyword 'scriptlet'. This behavior is characteristic of the 'Squiblydoo' technique, which abuses legitimate Windows binaries like Regsvr32 to execute arbitrary code, often for defense evasion.