Abuse of PowerShell MSXML COM Objects for Network Interaction

Adversaries frequently abuse PowerShell's ability to interact with COM objects to perform stealthy network operations or fetch remote payloads. Specifically, the use of MsXml2.ServerXmlHttp or MsXml2.XMLHTTP allows scripts to bypass traditional browser-based security controls when performing HTTP requests. This technique is often observed during the post-exploitation phase, where attackers attempt to download secondary stages or exfiltrate data. By invoking these COM objects, a script can instantiate an HTTP client directly within the PowerShell process memory, making the activity harder to distinguish from legitimate background administrative traffic. Defenders should monitor for the instantiation of these specific COM objects in conjunction with PowerShell, as this is a common TTP used by botnets and remote access trojans to establish C2.

Impact

Successful abuse of this technique enables an attacker to maintain persistent communication with command-and-control infrastructure, download additional malicious tools, and exfiltrate sensitive data from the host. This activity has been observed in various botnet campaigns where PowerShell is used for automated payload delivery.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) to capture the full command line and script body.
• Deploy the provided Sigma rule to detect the specific combination of 'New-Object', '-ComObject', and MSXML components in script blocks.
• Baseline administrative scripts in the environment to reduce false positives associated with legitimate use of COM objects for network tasks.