Submission Date: 2019/04/24

Update Date:

Information Domain: Host

Data Subtypes: Process

Analytic Type: TTP

Applicable Platforms: Windows

Contributors: MITRE



Squiblydoo is a specific usage of regsvr32.dll to load a COM scriptlet directly from the internet and execute it in a way that bypasses application whitelisting. It can be seen by looking for regsvr32.exe executions that load the scrobj.dll (which execute the COM scriptlet) or, if that is too noisy, those that also load content directly via HTTP or HTTPS.

Squiblydoo was first written up by Casey Smith at Red Canary, though that blog post is no longer accessible.

References

As usual, credit to Roberto Rodriguez and the ThreatHunter Playbook.

ATT&CK Detections

Technique Subtechnique(s) Tactic(s) Level of Coverage
System Binary Proxy Execution Regsvr32 Defense Evasion Moderate

D3FEND Techniques

ID Name
D3-PSA Process Spawn Analysis

Data Model References

Object Action Field
process create exe
process create command_line

Implementations

Splunk, Sysmon native

This looks for any and all usage of the scrobj DLL, which is what is used to run COM scriptlets, so it’ll detect both loading from network as well as filesystem. This will have almost zero false positives so is suitable for alerting.

index=__your_sysmon_events__ EventCode=1 regsvr32.exe scrobj.dll | search Image="*regsvr32.exe"

Eql, EQL native

EQL version of the above Splunk search.

process where subtype.create and
  (process_path == "*regsvr32.exe" and command_line == "*scrobj.dll")

Psuedocode, CAR

Pseudocode version of the above Splunk search.

processes = search Process:Create
squiblydoo_processes = filter processes where (
  image_path == "*regsvr32.exe" and command_line == "*scrobj.dll"
  )
output squiblydoo_processes

Logpoint, LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\regsvr32.exe" command="*scrobj.dll"

Unit Tests

Test Case 1

The Atomic Red Team test for Squiblydoo is a good test case for this.