T1546.015 Component Object Model Hijacking
Subtécnica de T1546 Event Triggered Execution
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Potential PSFactoryBuffer COM Hijackinghightest · windows
- Rundll32 Registered COM Objectshightest · windows
- SOURGUM Actor Behaviourshightest · windows
- COM Object Hijacking Via Modification Of Default System CLSID Default Valuehighexperimental · windows
- COM Hijacking via TreatAsmediumtest · windows
- Potential COM Object Hijacking Via TreatAs Subkey - Registrymediumtest · windows
- Potential Persistence Using DebugPathmediumtest · windows
- Potential Persistence Via Scrobj.dll COM Hijackingmediumtest · windows
- Suspicious GetTypeFromCLSID ShellExecutemediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.