Regsvr32 Squiblydoo COM Scriptlet Execution via Remote URL (T1218.010)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects execution of regsvr32.exe with command line arguments commonly used to execute remote scriptlets (SCT files) via HTTP/HTTPS, bypassing application control by leveraging a trusted Microsoft binary.