Windows Registry Detection: COM TreatAs(Default) Hijacking
Flags registry changes to COM TreatAs(Default) keys, excluding common Office/ClickToRun and installer processes.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-08-28
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry writes or changes to COM-related TreatAs(Default) keys where the target object ends with TreatAs\(Default). Attackers may abuse these COM handler settings to redirect execution to a desired command, enabling persistence or privilege escalation. The detection relies on registry_set telemetry capturing the TargetObject value, and it excludes common benign ClickToRun and Office integrator processes as well as svchost and msiexec-related activity.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
- youtube.comhttps://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Detection: COM TreatAs(Default) Hijacking"
id: 98f29228-1e4b-4c43-94e9-969d12d8134c
status: test
description: This rule identifies registry writes or changes to COM-related TreatAs(Default) keys where the target object ends with TreatAs\(Default). Attackers may abuse these COM handler settings to redirect execution to a desired command, enabling persistence or privilege escalation. The detection relies on registry_set telemetry capturing the TargetObject value, and it excludes common benign ClickToRun and Office integrator processes as well as svchost and msiexec-related activity.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
- https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml
author: frack113, Huntrule Team
date: 2022-08-28
modified: 2025-07-11
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.015
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: TreatAs\(Default)
filter_office:
Image|startswith: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\
Image|endswith: \OfficeClickToRun.exe
filter_office2:
Image:
- C:\Program Files\Microsoft Office\root\integration\integrator.exe
- C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe
filter_svchost:
Image: C:\Windows\system32\svchost.exe
filter_misexec:
Image:
- C:\Windows\system32\msiexec.exe
- C:\Windows\SysWOW64\msiexec.exe
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1
related:
- id: dc5c24af-6995-49b2-86eb-a9ff62199e82
type: derived