Regsvr32 Squiblydoo Remote SCT Scriptlet Execution - T1218.010
Detects usage of the Regsvr32.exe utility to load and execute remote scriptlets from an external HTTP source. This technique, often referred to as Squiblydoo, allows adversaries to bypass application control by leveraging a trusted, signed Windows binary to proxy the execution of malicious code without registering it in the registry.
SentinelOne
