PSFactoryBuffer COM InProcServer32 Registry Hijacking
The RomCom threat actor uses COM hijacking of the PSFactoryBuffer CLSID to establish persistence by redirecting execution to a malicious DLL via the InProcServer32 registry key.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Sources
- 4 public sources
- Freshness
- Revision 1Nov 13, 06:51 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
The RomCom threat actor has been observed utilizing COM hijacking to achieve persistence on compromised Windows systems. The attack involves modifying the InProcServer32 subkey for the PSFactoryBuffer CLSID ({c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}), which is normally associated with ActXPrxy.dll. By replacing the default value with a path to a malicious DLL, attackers ensure their code is loaded by processes that initialize this COM object.
Impact
Successful exploitation allows for the execution of code within the context of any process that loads the hijacked COM object, facilitating persistence.
Recommendation
- Deploy the provided Sigma rule to monitor for unauthorized modifications to the PSFactoryBuffer registry key.
- Baseline legitimate registry values for InProcServer32 to identify deviations from the standard ActXPrxy.dll paths.
Detection coverage 1
Detect PSFactoryBuffer COM Hijacking
highDetects changes to the PSFactory COM InProcServer32 registry key where the default value is changed from the expected ActXPrxy.dll path.
Detection queries are available on the platform. Get full rules →