{"id":"d06be4b9-8045-428b-a567-740a26d9db25","title":"Verclsid.exe Runs COM Object","description":"Detects when verclsid.exe is used to run COM object via GUID","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2025-10-07","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Verclsid/","https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5","https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"],"source_path":"rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml","source_sha256":"775a6462da57202e6a7b6227702165a10e87301b9bbcc4587f939fb86c10928a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Verclsid.exe Runs COM Object\nid: d06be4b9-8045-428b-a567-740a26d9db25\nstatus: test\ndescription: Detects when verclsid.exe is used to run COM object via GUID\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Verclsid/\n    - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5\n    - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/\nauthor: Victor Sergeev, oscd.community\ndate: 2020-10-09\nmodified: 2025-10-07\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\verclsid.exe'\n        - OriginalFileName: 'verclsid.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - '/S'\n            - '/C'\n    filter_main_runtimebroker:\n        ParentImage|endswith: 'C:\\Windows\\System32\\RuntimeBroker.exe'\n        CommandLine|contains|all:\n            - 'verclsid.exe\" /S /C {'\n            - '} /I {'\n    condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/d06be4b9-8045-428b-a567-740a26d9db25.json","kind":"sigma"}