{"id":"790317c0-0a36-4a6a-a105-6e576bf99a14","title":"COM Object Hijacking Via Modification Of Default System CLSID Default Value","description":"Detects potential COM object hijacking via modification of default system CLSID.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"experimental","level":"high","date":"2024-07-16","modified":"2025-11-10","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.015"],"technique_ids":["T1546.015"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Unlikely"],"references":["https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea)","https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/","https://blog.talosintelligence.com/uat-5647-romcom/","https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques","https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea","https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis","https://github.com/rtecCyberSec/BitlockMove","https://cert.gov.ua/article/6284080","https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/"],"source_path":"rules/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml","source_sha256":"f709bb2731fe2b4bf947bad36d42fcf2fb89be933db36acc233fd62910c70832","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: COM Object Hijacking Via Modification Of Default System CLSID Default Value\nid: 790317c0-0a36-4a6a-a105-6e576bf99a14\nrelated:\n    - id: 3d968d17-ffa4-4bc0-bfdc-f139de76ce77\n      type: obsolete\n    - id: a0ff33d8-79e4-4cef-b4f3-9dc4133ccd12\n      type: obsolete\nstatus: experimental\ndescription: Detects potential COM object hijacking via modification of default system CLSID.\nreferences:\n    - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea)\n    - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/\n    - https://blog.talosintelligence.com/uat-5647-romcom/\n    - https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques\n    - https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea\n    - https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis\n    - https://github.com/rtecCyberSec/BitlockMove\n    - https://cert.gov.ua/article/6284080\n    - https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-07-16\nmodified: 2025-11-10\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.015\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection_target_root:\n        TargetObject|contains: '\\CLSID\\'\n        TargetObject|endswith:\n            - '\\InprocServer32\\(Default)'\n            - '\\LocalServer32\\(Default)'\n    selection_target_builtin_clsid:\n        TargetObject|contains:\n            # Note: Add other legitimate CLSID\n            - '\\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\\'\n            - '\\{2155fee3-2419-4373-b102-6843707eb41f}\\'\n            - '\\{4590f811-1d3a-11d0-891f-00aa004b2e24}\\'\n            - '\\{4de225bf-cf59-4cfc-85f7-68b90f185355}\\'\n            - '\\{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}\\'\n            - '\\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\\'\n            - '\\{F82B4EF1-93A9-4DDE-8015-F7950A1A6E31}\\'\n            - '\\{7849596a-48ea-486e-8937-a2a3009f31a9}\\'\n            - '\\{0b91a74b-ad7c-4a9d-b563-29eef9167172}\\'\n            - '\\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\\'\n            - '\\{30D49246-D217-465F-B00B-AC9DDD652EB7}\\'\n            - '\\{A7A63E5C-3877-4840-8727-C1EA9D7A4D50}\\'\n            - '\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\'\n            - '\\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\\'\n            - '\\{AA509086-5Ca9-4C25-8F95-589D3C07B48A}\\'\n    selection_susp_location_1:\n        Details|contains:\n            # Note: Add more suspicious paths and locations\n            - ':\\Perflogs\\'\n            - '\\AppData\\Local\\'\n            - '\\Desktop\\'\n            - '\\Downloads\\'\n            - '\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n            - '\\System32\\spool\\drivers\\color\\' # as seen in the knotweed blog\n            - '\\Temporary Internet'\n            - '\\Users\\Public\\'\n            - '\\Windows\\Temp\\'\n            - '%appdata%'\n            - '%temp%'\n            - '%tmp%'\n    selection_susp_location_2:\n        - Details|contains|all:\n              - ':\\Users\\'\n              - '\\Favorites\\'\n        - Details|contains|all:\n              - ':\\Users\\'\n              - '\\Favourites\\'\n        - Details|contains|all:\n              - ':\\Users\\'\n              - '\\Contacts\\'\n        - Details|contains|all:\n              - ':\\Users\\'\n              - '\\Pictures\\'\n    condition: all of selection_target_* and 1 of selection_susp_location_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.015","id":"T1546.015","name":"Component Object Model Hijacking","page":"techniques/enterprise/T1546.015/"}],"data_path":"data/detection-rules/790317c0-0a36-4a6a-a105-6e576bf99a14.json","kind":"sigma"}