Skip to content
Threat Feed
Subscribe

Tag

Com

3 briefs RSS
medium threat

Potential Command and Control via Internet Explorer COM Abuse

This rule detects potential command and control activity where Internet Explorer (iexplore.exe) is started via the Component Object Model (COM) and makes unusual network connections, indicating adversaries might exploit Internet Explorer via COM to evade detection and bypass host-based firewall restrictions.

Internet Explorer command-and-control com iexplore windows
2r 4t
medium advisory

UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer

This threat brief details a UAC bypass technique leveraging the Internet Explorer Add-On Installer (ieinstal.exe) and Component Object Model (COM) to execute arbitrary code with elevated privileges.

Microsoft Defender XDR +2 uac-bypass privilege-escalation com ieinstal
2r 3t
medium advisory

Execution of COM object via Xwizard

Adversaries can abuse the legitimate system binary Xwizard to execute Component Object Model (COM) objects, evading defensive countermeasures by running COM objects created in the registry.

Windows execution defense-evasion com xwizard
2r 2t