COM Hijacking via Scrobj.dll Persistence

COM Hijacking involves exploiting the Windows Component Object Model (COM) registry lookup mechanism to force an application to load a malicious DLL or scriptlet instead of the intended component. The scrobj.dll (Microsoft Windows Script Component) is specifically targeted by adversaries because it provides a mechanism to execute scripts defined in external files, often referenced via a ScriptletURL registry key. By modifying the InprocServer32 registry subkey for specific COM classes and pointing them to a malicious path or leveraging scrobj.dll configurations, an attacker can ensure their code executes whenever the hijacked COM object is instantiated by a system process or a user-launched application. This technique allows for stealthy persistence, as the malicious code runs under the context of the calling process, potentially bypassing application allowlisting if the host process is trusted.

Impact

Successful exploitation results in unauthorized code execution with the privileges of the process loading the hijacked COM object. This can lead to persistent backdoor access, privilege escalation if a high-integrity process triggers the hijacked object, or the evasion of security monitoring that relies on path-based process execution controls.

Recommendation

Detection engineering teams should monitor registry modifications targeting COM object registration hives.

• Deploy the Sigma rule below to monitor for suspicious registration of scrobj.dll as an InprocServer32 handler.
• Enable Sysmon Event ID 12 and 13 to capture registry set and value modification events.
• Establish a baseline for legitimate COM registrations in the environment and investigate outliers that reference non-standard or user-writable paths.