Windows Registry Persistence via hhctrl.ocx Hijacking
Attackers may achieve persistence by modifying the InprocServer32 registry key for the hhctrl.ocx component to point to a custom binary.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 13, 06:51 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
Attackers can achieve persistence on Windows systems by modifying the default value of the registry key associated with the CLSID {52A2AAAE-085D-4187-97EA-8C30DB990436}, which corresponds to the HTML Help Control (hhctrl.ocx). By modifying the InprocServer32 registry entry to point to a custom binary, the attacker can influence system behavior.
Impact
Modifying this registry value facilitates persistence by enabling the execution of a specified binary when the component is loaded.
Recommendation
Monitor registry set events for modifications to the CLSID {52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32 where the value does not point to the expected system locations for hhctrl.ocx.
Detection coverage 1
Detect Registry Persistence via hhctrl.ocx Hijacking
highDetects when an attacker modifies the registry value of the hhctrl CLSID to point to a custom binary.
Detection queries are available on the platform. Get full rules →