Windows COM CLSID Hijacking via Registry Default InprocServer32/LocalServer32 Modification

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546.015Component Object Model Hijacking
Priv Esc
- T1546.015Component Object Model Hijacking
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows registry writes where the TargetObject path contains a CLSID and the Default value under InprocServer32 or LocalServer32 is targeted. Altering these default COM server locations can redirect COM activation to attacker-controlled code, enabling persistence or privilege escalation. It relies on registry_set telemetry, matching the CLSID registry path structure and suspicious value destinations within user-writable or commonly abused locations such as AppData, Temp, Startup, and Perflogs.

Reporting behind it

Related detections9 linkedT1546.015 — drag to rearrange

Suspicious COM Hijack of ClickOnce Deployment Service CLSID (via registry_set)

Suspicious COM Hijack Via InprocServer32 Modification

Malicious COM Hijacking via TinyTurla CLSID InprocServer32 (via registry_set)

Suspicious dllhost.exe Spawned with CLSID and Anomalous Parent (via process_creation)

Suspicious COM Handler Hijack of MsCtfMonitor CLSID via CharmingCypress

Malicious COM Hijack of PSFactoryBuffer InprocServer32

Malicious APT-C-60 COM Hijack via SpyGlace CLSID InProcServer32 (via registry_set)

Malicious COM Hijack via CLSID InProcServer32 Registry Modification (via registry_set)

Malicious COM Object Hijack Pointing to a User-Writable DLL (via registry_set)

Windows COM CLSID Hijacking via Registry Default InprocServer32/LocalServer32 Modification

Pivot detection · T1546.015 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-com-clsid-hijacking-via-registry-default-inprocserver32-localserver32-mo-790317c0

title: Windows COM CLSID Hijacking via Registry Default InprocServer32/LocalServer32 Modification
id: f28fbf38-9916-42d2-95af-5595a229ccc1
related:
  - id: 3d968d17-ffa4-4bc0-bfdc-f139de76ce77
    type: obsolete
  - id: a0ff33d8-79e4-4cef-b4f3-9dc4133ccd12
    type: obsolete
  - id: 790317c0-0a36-4a6a-a105-6e576bf99a14
    type: derived
status: experimental
description: This rule flags Windows registry writes where the TargetObject path contains a CLSID and the Default value under InprocServer32 or LocalServer32 is targeted. Altering these default COM server locations can redirect COM activation to attacker-controlled code, enabling persistence or privilege escalation. It relies on registry_set telemetry, matching the CLSID registry path structure and suspicious value destinations within user-writable or commonly abused locations such as AppData, Temp, Startup, and Perflogs.
references:
  - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea)
  - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
  - https://blog.talosintelligence.com/uat-5647-romcom/
  - https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques
  - https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea
  - https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis
  - https://github.com/rtecCyberSec/BitlockMove
  - https://cert.gov.ua/article/6284080
  - https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-16
modified: 2025-11-10
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.015
logsource:
  category: registry_set
  product: windows
detection:
  selection_target_root:
    TargetObject|contains: \CLSID\
    TargetObject|endswith:
      - \InprocServer32\(Default)
      - \LocalServer32\(Default)
  selection_target_builtin_clsid:
    TargetObject|contains:
      - \{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\
      - \{2155fee3-2419-4373-b102-6843707eb41f}\
      - \{4590f811-1d3a-11d0-891f-00aa004b2e24}\
      - \{4de225bf-cf59-4cfc-85f7-68b90f185355}\
      - \{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}\
      - \{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\
      - \{F82B4EF1-93A9-4DDE-8015-F7950A1A6E31}\
      - \{7849596a-48ea-486e-8937-a2a3009f31a9}\
      - \{0b91a74b-ad7c-4a9d-b563-29eef9167172}\
      - \{603D3801-BD81-11d0-A3A5-00C04FD706EC}\
      - \{30D49246-D217-465F-B00B-AC9DDD652EB7}\
      - \{A7A63E5C-3877-4840-8727-C1EA9D7A4D50}\
      - \{2227A280-3AEA-1069-A2DE-08002B30309D}\
      - \{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\
      - \{AA509086-5Ca9-4C25-8F95-589D3C07B48A}\
  selection_susp_location_1:
    Details|contains:
      - :\Perflogs\
      - \AppData\Local\
      - \Desktop\
      - \Downloads\
      - \Microsoft\Windows\Start Menu\Programs\Startup\
      - \System32\spool\drivers\color\
      - \Temporary Internet
      - \Users\Public\
      - \Windows\Temp\
      - "%appdata%"
      - "%temp%"
      - "%tmp%"
  selection_susp_location_2:
    - Details|contains|all:
        - :\Users\
        - \Favorites\
    - Details|contains|all:
        - :\Users\
        - \Favourites\
    - Details|contains|all:
        - :\Users\
        - \Contacts\
    - Details|contains|all:
        - :\Users\
        - \Pictures\
  condition: all of selection_target_* and 1 of selection_susp_location_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL