Sigma rule: Potential PSFactoryBuffer COM Hijacking

Rule

Title

Potential PSFactoryBuffer COM Hijacking

Status

test

Level

high

Author

BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk

Date

2023-06-07

Modified

2023-08-17

File

rules/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'
filter_main:
    Details:
        - '%windir%\System32\ActXPrxy.dll'
        - 'C:\Windows\System32\ActXPrxy.dll'
condition: selection and not filter_main

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1546.015

MITRE ATT&CK ids this rule names

• T1546.015

References

• https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
• https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html
• https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection
• https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml