{"id":"dc5c24af-6995-49b2-86eb-a9ff62199e82","title":"COM Hijacking via TreatAs","description":"Detect modification of TreatAs key to enable \"rundll32.exe -sta\" command","author":"frack113","status":"test","level":"medium","date":"2022-08-28","modified":"2025-07-11","tags":["attack.privilege-escalation","attack.persistence","attack.t1546.015"],"technique_ids":["T1546.015"],"logsource":{"category":"registry_set","product":"windows"},"falsepositives":["Legitimate use"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md","https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s"],"source_path":"rules/windows/registry/registry_set/registry_set_treatas_persistence.yml","source_sha256":"3fe904bd9433b488847a69e767b3840ef925637c7d80571183120a9239cddc74","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: COM Hijacking via TreatAs\nid: dc5c24af-6995-49b2-86eb-a9ff62199e82\nstatus: test\ndescription: Detect modification of TreatAs key to enable \"rundll32.exe -sta\" command\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md\n    - https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s\nauthor: frack113\ndate: 2022-08-28\nmodified: 2025-07-11\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1546.015\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith: 'TreatAs\\(Default)'\n    filter_office:\n        Image|startswith: 'C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\'\n        Image|endswith: '\\OfficeClickToRun.exe'\n    filter_office2:\n        Image:\n            - 'C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe'\n            - 'C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe'\n    filter_svchost:\n        # Example of target object by svchost\n        # TargetObject: HKLM\\SOFTWARE\\Microsoft\\MsixRegistryCompatibility\\Package\\Microsoft.Paint_11.2208.6.0_x64__8wekyb3d8bbwe\\User\\SOFTWARE\\Classes\\CLSID\\{0003000A-0000-0000-C000-000000000046}\\TreatAs\\(Default)\n        # TargetObject: HKU\\S-1-5-21-1000000000-000000000-000000000-0000_Classes\\CLSID\\{0003000A-0000-0000-C000-000000000046}\\TreatAs\\(Default)\n        Image: 'C:\\Windows\\system32\\svchost.exe'\n    filter_misexec:\n        # This FP has been seen during installation/updates\n        Image:\n            - 'C:\\Windows\\system32\\msiexec.exe'\n            - 'C:\\Windows\\SysWOW64\\msiexec.exe'\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Legitimate use\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.015","id":"T1546.015","name":"Component Object Model Hijacking","page":"techniques/enterprise/T1546.015/"}],"data_path":"data/detection-rules/dc5c24af-6995-49b2-86eb-a9ff62199e82.json","kind":"sigma"}