Regsvr32 Proxy Execution

Adversaries may abuse the signed Windows regsvr32.exe utility to proxy execution through local DLLs or COM scriptlets. The remote scriptlet variant passes a URL to scrobj.dll and can execute under the current user's permissions without registering the COM object. Regsvr32 also has legitimate Windows uses, so its presence alone is not evidence of malicious activity.