Blessed Squiblydoo, Who Spoke in the Voice of Trusted Programs

Patron of Microsoft-signed binaries, over-optimistic allowlists, and those who live off other people's land.

Life

In April 2016 Casey Smith, known as subTee, showed that regsvr32, an old Windows tool for registering components, could load a scriptlet from a remote address and run it, getting past AppLocker. It was not a bug with a patch but a technique: using a trusted program to do what an unknown one could not. The silly name stuck, and the technique became a living-off-the-land classic.

Prayer

O Blessed Squiblydoo, who puts words in trusted programs' mouths, let our rules watch what is done and not only who does it. Amen.

How to celebrate

Celebrated by restricting regsvr32 with WDAC, blocking its outbound traffic, and fondly browsing the LOLBAS catalogue.

A signed habit does not make the monk.