Windows Registry Detection: COM TreatAs(Default) Hijacking

title: "Windows Registry Detection: COM TreatAs(Default) Hijacking"
id: 98f29228-1e4b-4c43-94e9-969d12d8134c
status: test
description: This rule identifies registry writes or changes to COM-related TreatAs(Default) keys where the target object ends with TreatAs\(Default). Attackers may abuse these COM handler settings to redirect execution to a desired command, enabling persistence or privilege escalation. The detection relies on registry_set telemetry capturing the TargetObject value, and it excludes common benign ClickToRun and Office integrator processes as well as svchost and msiexec-related activity.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
  - https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml
author: frack113, Huntrule Team
date: 2022-08-28
modified: 2025-07-11
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.015
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: TreatAs\(Default)
  filter_office:
    Image|startswith: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
    Image|endswith: \OfficeClickToRun.exe
  filter_office2:
    Image:
      - C:\Program Files\Microsoft Office\root\integration\integrator.exe
      - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
  filter_svchost:
    Image: C:\Windows\system32\svchost.exe
  filter_misexec:
    Image:
      - C:\Windows\system32\msiexec.exe
      - C:\Windows\SysWOW64\msiexec.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: dc5c24af-6995-49b2-86eb-a9ff62199e82
    type: derived