regsvr32

Windows CMD execution T1218.010

Registers and unregisters OLE controls. Can execute remote scriptlets (scrobj.dll) — the 'Squiblydoo' technique.

Binary Paths

  • C:\Windows\System32\regsvr32.exe
  • C:\Windows\SysWOW64\regsvr32.exe

Glob Patterns

Pattern Wildcards Notes
for /f %i in ('where regsvr3?.exe') do %i
? Wildcard replaces '2'
for /f %i in ('where r*svr32.exe') do %i
* Star replaces 'eg'
for /f %i in ('where regsvr*.exe') do %i
* Star matches '32'
for /f %i in ('dir /b C:\Windows\System32\regsvr*.exe') do %i
* dir glob search

Resources

← Back to Catalog