Sigma rule: Verclsid.exe Runs COM Object

Rule

Title

Verclsid.exe Runs COM Object

Status

test

Level

medium

Author

Victor Sergeev, oscd.community

Date

2020-10-09

Modified

2025-10-07

File

rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when verclsid.exe is used to run COM object via GUID

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\verclsid.exe'
    - OriginalFileName: 'verclsid.exe'
selection_cli:
    CommandLine|contains|all:
        - '/S'
        - '/C'
filter_main_runtimebroker:
    ParentImage|endswith: 'C:\Windows\System32\RuntimeBroker.exe'
    CommandLine|contains|all:
        - 'verclsid.exe" /S /C {'
        - '} /I {'
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1218

MITRE ATT&CK ids this rule names

• T1218

References

• https://lolbas-project.github.io/lolbas/Binaries/Verclsid/
• https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
• https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml