Skip to content
Threat Feed

Tag

Com

2 briefs RSS
medium threat

Potential Command and Control via Internet Explorer COM Abuse

This rule detects potential command and control activity where Internet Explorer (iexplore.exe) is started via the Component Object Model (COM) and makes unusual network connections, indicating adversaries might exploit Internet Explorer via COM to evade detection and bypass host-based firewall restrictions.

Internet Explorer command-and-control com iexplore windows
2r 4t
medium advisory

UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer

This threat brief details a UAC bypass technique leveraging the Internet Explorer Add-On Installer (ieinstal.exe) and Component Object Model (COM) to execute arbitrary code with elevated privileges.

Microsoft Defender XDR +2 uac-bypass privilege-escalation com ieinstal
2r 3t