Component Object Model Hijacking

Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects.

Rule type: eql

Rule indices:

winlogbeat-*
logs-endpoint.events.*
logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/

Tags:

Elastic
Host
Windows
Threat Detection
Persistence

Version: 4 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 7.14.0

Rule authors: Elastic

Rule license: Elastic License v2

Rule query

edit

registry where /* uncomment once length is stable
length(bytes_written_string) > 0 and */ (registry.path :
"HK*}\\InprocServer32\\" and registry.data.strings: ("scrobj.dll",
"C:\\*\\scrobj.dll") and not registry.path :
"*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or /* in general
COM Registry changes on Users Hive is less noisy and worth alerting */
(registry.path : ("HKEY_USERS\\*Classes\\*\\InprocServer32\\",
"HKEY_USERS\\*Classes\\*\\LocalServer32\\",
"HKEY_USERS\\*Classes\\*\\DelegateExecute\\",
"HKEY_USERS\\*Classes\\*\\TreatAs\\",
"HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and /* not
necessary but good for filtering privileged installations */
user.domain != "NT AUTHORITY")

Threat mapping

edit

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Event Triggered Execution
- ID: T1546
- Reference URL: https://attack.mitre.org/techniques/T1546/

Rule version history

edit

Version 4 (7.14.0 release)

Updated query, changed from:

registry where /* uncomment once length is stable
length(bytes_written_string) > 0 and */ (registry.path :
"HK*}\\InprocServer32\\" and registry.data.strings: ("scrobj.dll",
"C:\\*\\scrobj.dll") and not registry.path :
"*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*") or /* in general
COM Registry changes on Users Hive is less noisy and worth alerting */
(registry.path : ("HKEY_USERS\\*Classes\\*\\InprocXServer32\\",
"HKEY_USERS\\*Classes\\*\\LocalServer32\\",
"HKEY_USERS\\*Classes\\*\\DelegateExecute\\",
"HKEY_USERS\\*Classes\\*\\TreatAs\\",
"HKEY_USERS\\*Classes\\CLSID\\*\\ScriptletURL\\") and /* not
necessary but good for filtering privileged installations */
user.domain != "NT AUTHORITY")

Version 3 (7.12.0 release)

Formatting only

Version 2 (7.11.2 release)

Formatting only

« Command Shell Activity Started via RunDLL32 Conhost Spawned By Suspicious Parent Process »