Squiblydoo regsvr32.exe Remote COM Scriptlet via HTTP/HTTPS URL
Detects the use of regsvr32.exe with the /s (silent), /u (unregister), and /i (install) flags to execute a remote COM scriptlet (SCT) via an HTTP or HTTPS URL. This is a known technique (often referred to as Squiblydoo) to bypass application control by leveraging a trusted, signed Windows binary to download and execute code from a remote server.
SentinelOne
