How do you detect rundll32 and regsvr32 abuse?

Detect regsvr32 abuse by flagging scrobj.dll, a /i: argument pointing at an http or UNC path, or a DLL or scriptlet in a user-writable folder, which is the squiblydoo pattern. Detect rundll32 abuse by alerting on javascript: or vbscript: handlers, remote DLL paths, comsvcs.dll MiniDump, ordinal-only calls and DLLs in Temp or AppData, and on rundll32 with no arguments. Add Sysmon Event 3 alerts for outbound connections from either binary, and match on OriginalFileName so renamed copies are caught.

Detecting Rundll32 and Regsvr32 Proxy Execution

Rundll32 loads and runs an exported function from a DLL; regsvr32 registers COM servers and, with the right switches, will fetch and execute a remote scriptlet. Both are signed, both are present everywhere and both turn up in loaders, macro droppers and credential dumping. The legitimate usage envelope is narrow, which is what makes them detectable.

Signals at a Glance

Signal	Where	ATT&CK
regsvr32 /s /n /u /i:http(s) with scrobj.dll (squiblydoo)	Sysmon 1, 4688	T1218.010
regsvr32 loading a DLL or .sct from a user-writable path	Sysmon 1, 7	T1218.010
rundll32 with javascript:, vbscript: or a UNC or http path	Sysmon 1, 4688	T1218.011
rundll32 invoking comsvcs.dll MiniDump, or calling an ordinal such as #1 or #24	Sysmon 1	T1218.011
regsvr32 or rundll32 making outbound network connections	Sysmon 3	T1218

Regsvr32 and Squiblydoo

Squiblydoo abuses regsvr32 to download and run a scriptlet through scrobj.dll without writing to disk, which also sidesteps some application control. Real registration work does not use a remote URL, so the pattern is both simple and reliable:

title: Regsvr32 Remote Scriptlet or Suspicious DLL Path
logsource:
  product: windows
  category: process_creation
detection:
  image:
    - Image|endswith: '\regsvr32.exe'
    - OriginalFileName: 'REGSVR32.EXE'
  remote:
    CommandLine|contains:
      - 'scrobj.dll'
      - '/i:http'
      - '/i:\\'
      - ' /n '
  user_path:
    CommandLine|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  condition: image and (remote or user_path)
level: high
# tune/validate: some software registers DLLs from ProgramData during install.

Rundll32 Patterns

Rundll32 has more legitimate use, so rank by arguments rather than alerting on the binary. These indicators are worth separate rules; the Splunk search below combines the highest-fidelity ones:

index=sysmon EventCode=1 (Image="*\\rundll32.exe" OR OriginalFileName="RUNDLL32.EXE")
  (CommandLine="*javascript:*" OR CommandLine="*vbscript:*"
   OR CommandLine="*comsvcs*MiniDump*" OR CommandLine="*comsvcs*#24*"
   OR CommandLine="*\\\\*,*" OR CommandLine="*http*,*"
   OR CommandLine IN ("*AppData*.dll,*","*\\Temp\\*.dll,*","*Public*.dll,*"))
| stats count values(ParentImage) as parents by host, user, CommandLine
| sort - count
`comment("tune/validate: confirm the MiniDump pattern also has a dedicated, higher-severity credential rule")`

Rundll32 with no arguments is a classic injection host for post-exploitation frameworks; alert on it separately from the argument-based rules.
Alert when either binary has Sysmon Event 3 outbound connections, and especially when the destination is external.
Check the DLL itself: unsigned, recently created or in a writable path moves a low-severity finding to high.
Monitor COM registration: HKCU\Software\Classes\CLSID writes by regsvr32 can indicate persistence.

Vetted sources

Use LOLBAS entries for Rundll32 and Regsvr32, the SigmaHQ rules for squiblydoo, scrobj.dll and rundll32 abuse, Elastic’s detections for both, Splunk ESCU content, MITRE CAR analytics and Atomic Red Team tests for T1218.010 and T1218.011. Baseline your own environment — installers and shell extensions use both binaries.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Regsvr32 and Squiblydoo

Rundll32 Patterns

Build Detections That Fire

Defense Evasion Detection

Detection Hub

LOLBin Abuse Detection

MSBuild and InstallUtil Detection