Detectionmediumtest
Potential COM Object Hijacking Via TreatAs Subkey - Registry
Detects COM object hijacking via TreatAs subkey
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Kutepov Anton, oscd.communityCreated Wed Oct 23Updated Sun Oct 269b0f8a61-91b2-464f-aceb-0527e0a45020windows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic2 selectors
detection:
selection:
TargetObject|contains|all:
- 'HKU\'
- 'Classes\CLSID\'
- '\TreatAs'
filter_main_svchost:
# Example of target object by svchost
# TargetObject: HKU\S-1-5-21-1098798288-3663759343-897484398-1001_Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs
Image: 'C:\WINDOWS\system32\svchost.exe'
condition: selection and not 1 of filter_main_*False Positives
Maybe some system utilities in rare cases use linking keys for backward compatibility
References
Testing & Validation
Simulations
atomic-red-teamT1546.015
View on ARTCOM hijacking via TreatAs
GUID: 33eacead-f117-4863-8eb0-5c6304fbfaa9
MITRE ATT&CK
Rule Metadata
Rule ID
9b0f8a61-91b2-464f-aceb-0527e0a45020
Status
test
Level
medium
Type
Detection
Created
Wed Oct 23
Modified
Sun Oct 26
Author
Path
rules/windows/registry/registry_set/registry_set_persistence_com_key_linking.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.t1546.015