Skip to content
Threat Feed
Subscribe
high advisory

COM Object Hijacking via Registry Modification

Adversaries modify default system CLSID registry keys to point to malicious DLLs or executables, enabling persistence and privilege escalation.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 08:46 UTC
Detection
1 rule
Source quality
A1Likely

Adversaries abuse the Component Object Model (COM) by hijacking legitimate CLSID (Class Identifier) entries. By modifying the (Default) value of InprocServer32 or LocalServer32 registry keys for specific built-in system COM objects, attackers can execute arbitrary code when those objects are initialized by legitimate processes. This technique is frequently observed in malware campaigns to achieve stealthy persistence and privilege escalation.

Impact

Successful hijacking allows for the execution of arbitrary code in the context of the host process, which may lead to privilege escalation or persistent access to the system.

Recommendation

Deploy the provided Sigma rule to monitor registry modifications targeting InprocServer32 and LocalServer32 keys, specifically filtering for paths associated with non-system or temporary directories. Audit existing COM object registrations periodically to identify unauthorized changes.

Immediate actions

Deploy the Sigma detection rule to monitor Registry Event ID 13.

Detection Engineering 48h

Threat Hunt

Identify registry modifications in CLSID subkeys pointing to user-writable directories.

T1546.015 high high confidence convert to detection

Data: Registry set telemetry (Event ID 13)

Mitigations

Implement application control policies to restrict execution from writable directories like AppData or Temp.

medium IT Operations

T1546.015

Detection coverage 1

Detect COM Object Hijacking via System CLSID Modification

high

Detects modification of COM InprocServer32 or LocalServer32 registry keys that point to suspicious, non-standard file paths.

sigma tactics: persistence, privilege-escalation techniques: T1546.015 sources: registry_set, windows

Detection queries are available on the platform. Get full rules →