Detection of Malicious COM Object Instantiation via PowerShell

Adversaries and ransomware groups, including those linked to Conti, frequently leverage the instantiation of Component Object Model (COM) objects through PowerShell to execute arbitrary code. By using the [type]::GetTypeFromCLSID method, attackers can interact with system-level COM components, often to achieve privilege escalation or bypass User Account Control (UAC) protections. This technique provides a mechanism for persistence and unauthorized system manipulation. Security operations teams should monitor PowerShell Script Block Logging (EventID 4104) for instances of this method, as it serves as a high-fidelity indicator of potentially malicious script execution that bypasses traditional file-based detection.

Attack Chain

1. Attacker establishes initial access through social engineering or exploitation of a separate vulnerability.
2. Attacker executes a PowerShell script on the target endpoint.
3. The script calls [type]::GetTypeFromCLSID to identify and load a specific COM object.
4. The script creates an instance of the targeted COM object using CreateInstance.
5. The instantiated COM object is used to interact with privileged system APIs or administrative interfaces.
6. Attacker performs UAC bypass or privilege escalation to elevate the current process context.
7. Attacker achieves persistence or executes further malicious payloads, such as ransomware binaries or data wipers.

Impact

Successful exploitation of this technique can result in complete system compromise, including privilege escalation and the disabling of security features. It has been observed in campaigns involving ransomware and data destruction tools, posing risks of significant operational downtime, data loss, and unauthorized access to sensitive environments.

Recommendation

• Enable and ingest Windows PowerShell Script Block Logging (Event ID 4104) to monitor for the specific CLSID instantiation pattern.
• Deploy the provided Sigma rule to detect [type]::GetTypeFromCLSID usage in script blocks.
• Investigate alerts generated by this logic to distinguish between legitimate administrative tool usage and adversarial activity.
• Restrict PowerShell execution policies and enforce Constrained Language Mode (CLM) in sensitive environments to limit COM object access.