Detection of PowerShell COM Hijacking via InProcServer32 Modification

This threat involves the abuse of the Component Object Model (COM) by modifying or creating registry keys within the InProcServer32 path using PowerShell. This technique allows an attacker to register a malicious DLL, which is subsequently loaded by legitimate COM-enabled processes on the system. By controlling the execution flow of these processes, an adversary can achieve persistence, escalate privileges, or execute arbitrary code. The activity is typically observed via PowerShell ScriptBlock Logging (EventCode 4104), as attackers utilize PowerShell commands to interact with the Windows Registry. Defenders should monitor for scripts containing references to Software\Classes\CLSID\ followed by InProcServer32 to identify potential unauthorized modifications to the registry.

Attack Chain

1. An attacker gains initial access to the system via phishing, exploit, or other delivery mechanism.
2. The attacker identifies a target COM object (CLSID) that is frequently invoked by system processes or applications.
3. The attacker writes a malicious DLL to the disk in a location accessible to the target process.
4. The attacker executes a PowerShell command to modify the registry key HKCU\Software\Classes\CLSID\{CLSID}\InProcServer32 to point to the malicious DLL path.
5. The target application or system process triggers the COM object, causing the system to load the malicious DLL.
6. The malicious code within the DLL executes in the context of the host process, providing persistence or elevated access.

Impact

Successful COM hijacking can lead to unauthorized code execution, local privilege escalation, and long-term system persistence. This technique is often used by advanced persistent threats to blend in with legitimate system activity, making it difficult to detect without deep visibility into script execution and registry modifications. The exact impact depends on the process that loads the hijacked COM object, potentially granting the attacker system-level or administrative rights.

Recommendation

• Enable and ingest Windows PowerShell ScriptBlock Logging (EventCode 4104) across all endpoints to capture the full content of executed scripts.
• Deploy the provided Sigma rule to your SIEM to detect attempts to modify InProcServer32 registry keys using PowerShell.
• Regularly audit the HKCU\Software\Classes\CLSID and HKLM\Software\Classes\CLSID registry paths for unauthorized or suspicious DLL associations.
• Investigate alerts generated by this rule to determine if the script is part of an authorized maintenance activity or malicious persistence attempt.