Sigma rule: Potential Persistence Via COM Search Order Hijacking

Rule

Title

Potential Persistence Via COM Search Order Hijacking

Status

deprecated

Level

medium

Author

Maxime Thiebaut (@0xThiebaut), oscd.community, Cédric Hien

Date

2020-04-14

Modified

2024-09-02

File

deprecated/windows/registry_set_persistence_search_order.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential COM object hijacking leveraging the COM Search Order

Log source

product

windows

category

registry_set

Detection

selection: # Detect new COM servers in the user hive
    TargetObject|contains: '\CLSID\'
    TargetObject|endswith: '\InprocServer32\(Default)'
filter_main_generic:
    Details|contains: # Exclude privileged directories and observed FPs
        - '%%systemroot%%\system32\'
        - '%%systemroot%%\SysWow64\'
filter_main_onedrive:
    Details|contains:
        # Related To OneDrive
        - '\AppData\Local\Microsoft\OneDrive\'
        - '\FileCoAuthLib64.dll'
        - '\FileSyncShell64.dll'
        - '\FileSyncApi64.dll'
filter_main_health_service:
    Image|endswith: ':\WINDOWS\system32\SecurityHealthService.exe'
filter_main_teams:
    Details|contains|all:
        - '\AppData\Local\Microsoft\TeamsMeetingAddin\'
        - '\Microsoft.Teams.AddinLoader.dll'
filter_main_dropbox:
    Details|contains|all:
        - '\AppData\Roaming\Dropbox\'
        - '\DropboxExt64.*.dll'
filter_main_trend_micro:
    Details|endswith: 'TmopIEPlg.dll' # TrendMicro osce
filter_main_update:
    Image|endswith:
        - ':\WINDOWS\system32\wuauclt.exe'
        - ':\WINDOWS\system32\svchost.exe'
filter_main_defender:
    Image|contains:
        - ':\ProgramData\Microsoft\Windows Defender\Platform\'
        - ':\Program Files\Windows Defender\'
    Image|endswith: '\MsMpEng.exe'
filter_main_nvidia:
    Details|contains: '\FileRepository\nvmdi.inf'
filter_main_edge:
    Image|endswith: '\MicrosoftEdgeUpdateComRegisterShell64.exe'
filter_main_dx:
    Image|endswith: ':\WINDOWS\SYSTEM32\dxdiag.exe'
filter_main_python:
    Details|endswith:
        - ':\Windows\pyshellext.amd64.dll'
        - ':\Windows\pyshellext.dll'
filter_main_bonjourlib:
    Details|endswith:
        - ':\Windows\system32\dnssdX.dll'
        - ':\Windows\SysWOW64\dnssdX.dll'
filter_main_printextensionmanager:
    Details|endswith: ':\Windows\system32\spool\drivers\x64\3\PrintConfig.dll'
filter_main_programfiles:
    Details|contains:
        - ':\Program Files\'
        - ':\Program Files (x86)\'
filter_main_programdata:
    Details|contains: ':\ProgramData\Microsoft\'
filter_main_gameservice:
    Details|contains: ':\WINDOWS\system32\GamingServicesProxy.dll'
filter_main_poqexec:
    Image|endswith: ':\Windows\System32\poqexec.exe'
    Details|contains: ':\Windows\System32\Autopilot.dll'
filter_main_sec_health_svc:
    Image|endswith: ':\Windows\system32\SecurityHealthService.exe'
    Details|contains: ':\Windows\System32\SecurityHealth'
filter_main_inprocserver:
    Image|endswith:
        - ':\Windows\System32\poqexec.exe'
        - ':\Windows\System32\regsvr32.exe'
    TargetObject|endswith: '\InProcServer32\(Default)'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Some installed utilities (i.e. OneDrive) may serve new COM objects at user-level

Tags

• attack.persistence
• attack.t1546.015

MITRE ATT&CK ids this rule names

• T1546.015

Related rules

• 790317c0-0a36-4a6a-a105-6e576bf99a14 (derived)

References

• https://www.cyberbit.com/blog/endpoint-security/com-hijacking-windows-overlooked-security-vulnerability/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/registry_set_persistence_search_order.yml