Sigma rule: COM Hijacking via TreatAs

Rule

Title

COM Hijacking via TreatAs

Status

test

Level

medium

Author

frack113

Date

2022-08-28

Modified

2025-07-11

File

rules/windows/registry/registry_set/registry_set_treatas_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|endswith: 'TreatAs\(Default)'
filter_office:
    Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
filter_office2:
    Image:
        - 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
        - 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
filter_svchost:
    # Example of target object by svchost
    # TargetObject: HKLM\SOFTWARE\Microsoft\MsixRegistryCompatibility\Package\Microsoft.Paint_11.2208.6.0_x64__8wekyb3d8bbwe\User\SOFTWARE\Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs\(Default)
    # TargetObject: HKU\S-1-5-21-1000000000-000000000-000000000-0000_Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs\(Default)
    Image: 'C:\Windows\system32\svchost.exe'
filter_misexec:
    # This FP has been seen during installation/updates
    Image:
        - 'C:\Windows\system32\msiexec.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Legitimate use

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1546.015

MITRE ATT&CK ids this rule names

• T1546.015

References

• https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
• https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_treatas_persistence.yml