T1546.015PersistencePrivilege Escalation
Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
9 Sigma rules tagged T1546.015Component Object Model HijackingT1546.0159 general rules
- Potential PSFactoryBuffer COM Hijackinghightest
- Rundll32 Registered COM Objectshightest
- SOURGUM Actor Behaviourshightest
- COM Object Hijacking Via Modification Of Default System CLSID Default Valuehighexperimental
- COM Hijacking via TreatAsmediumtest
- Potential COM Object Hijacking Via TreatAs Subkey - Registrymediumtest
- Potential Persistence Using DebugPathmediumtest
- Potential Persistence Via Scrobj.dll COM Hijackingmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Component Object Model Hijacking
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.