MITRE ATT&CK technique · Privilege Escalation, Persistence

`T1546.015` Component Object Model Hijacking

Sub-technique of T1546 Event Triggered Execution

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT28

Sigma rules to hunt it

Potential PSFactoryBuffer COM Hijackinghightest · windows
Rundll32 Registered COM Objectshightest · windows
SOURGUM Actor Behaviourshightest · windows
COM Object Hijacking Via Modification Of Default System CLSID Default Valuehighexperimental · windows
COM Hijacking via TreatAsmediumtest · windows
Potential COM Object Hijacking Via TreatAs Subkey - Registrymediumtest · windows
Potential Persistence Using DebugPathmediumtest · windows
Potential Persistence Via Scrobj.dll COM Hijackingmediumtest · windows
Suspicious GetTypeFromCLSID ShellExecutemediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.