Living-off-the-Land: Xwizard.exe COM object execution

Xwizard.exe is a legitimate Windows utility that can be leveraged to execute COM objects specified in the Windows registry. Threat actors may abuse this functionality by invoking the tool with the "RunWizard" command line argument followed by a specific Class ID (CLSID) to execute arbitrary code or payloads.

Impact

Execution of arbitrary COM objects can lead to code execution under the context of the user running the utility, potentially allowing for persistence or evasion of traditional signature-based security controls by utilizing a signed Microsoft binary.

Recommendation

• Deploy the provided Sigma rule to detect suspicious Xwizard execution patterns in process creation logs.
• Baseline legitimate usage of Xwizard.exe in your environment to distinguish between system activity and potential abuse.
• Monitor registry modifications (e.g., CLSID keys) that correlate with unexpected process spawns involving Xwizard.