Squiblydoo

Hypothesis and description

Squiblydoo is a specific usage of regsvr32.dll to load a COM scriptlet directly from the internet and execute it in a way that bypasses application whitelisting. It can be seen by looking for regsvr32.exe executions that load the scrobj.dll (which execute the COM scriptlet) or, if that is too noisy, those that also load content directly via HTTP or HTTPS.

Squiblydoo was first written up by Casey Smith at Red Canary, though that blog post is no longer accessible.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2019-04-24
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1218 System Binary Proxy ExecutionT1218.010	Stealth (formerly Defense Evasion)	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1218System Binary Proxy Execution
.010 Regsvr32

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodeData model: CAR

Pseudocode version of the above Splunk search.

processes = search Process:Create
squiblydoo_processes = filter processes where (
  image_path == "*regsvr32.exe" and command_line == "*scrobj.dll"
  )
output squiblydoo_processes

SplunkData model: Sysmon native

This looks for any and all usage of the scrobj DLL, which is what is used to run COM scriptlets, so it'll detect both loading from network as well as filesystem. This will have almost zero false positives so is suitable for alerting.

index=__your_sysmon_events__ EventCode=1 regsvr32.exe scrobj.dll | search Image="*regsvr32.exe"

EQLData model: EQL native

EQL version of the above Splunk search.

process where subtype.create and
  (process_path == "*regsvr32.exe" and command_line == "*scrobj.dll")

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\regsvr32.exe" command="*scrobj.dll"

References (from MITRE CAR)

As usual, credit to Roberto Rodriguez and the ThreatHunter Playbook.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

28 more in the full list

View CAR-2019-04-003 on car.mitre.org

Hypothesis and description

Squiblydoo was first written up by Casey Smith at Red Canary, though that blog post is no longer accessible.

Technique

Tactics

Coverage

T1218 System Binary Proxy ExecutionT1218.010

Stealth (formerly Defense Evasion)

Moderate