Query: detect Detects potential COM object hijacking via modification of default system CLSID. in logs
Matching passage: Sigma rule: Detects potential COM object hijacking via modification of default system CLSID.. Logsource: windows / registry_set. Rule: title: COM Object Hijacking Via Modification Of Default System CLSID Default Value id: 790317c0-0a36-4a6a-a105-6e576bf99a14 related: - id: 3d968d17-ffa4-4bc0-bfdc-f139de76ce77 type: obsolete - id: a0ff33d8-79e4-4cef-b4f3-9dc4133ccd12 type: obsolete status: experimental description: Detects potential COM object hijacking via modification of default system CLSID. references: - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea) - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/ - https://blog.talosintelligence.com/uat-5647-romcom/ - https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques - https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea - https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis - https://github.com/rtecCyberSec/BitlockMove - https://cert.gov.ua/article/6284080 - https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-16 modified: 2025-11-10 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection_target_root: TargetObject|contains: \CLSID\ TargetObject|endswith: - \InprocServer32\(Default) - \LocalServer32\(Default) selection_target_builtin_clsid: TargetObject|contains: - \{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\ - \{2155fee3-2419-4373-b102-6843707eb41f}\ - \{4590f811-1d3a-11d0-891f-00aa004b2e24}\ - \{4de225bf-cf59-4cfc-85f7-68b90f185355}\ - \{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}\ - \{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\ - \{F82B4EF1-93A9-4DDE-8015-F7950A1A6E31}\ - \{7849596a-48ea-486e-8937-a2a3009f31a9}\ - \{0b91a74b-ad7c-4a9d-b563-29eef9167172}\ - \{603D3801-BD81-11d0-A3A5-00C04FD706EC}\ - \{30D49246-D217-465F-B00B-AC9DDD652EB7}\ - \{A7A63E5C-3877-4840-8727-C1EA9D7A4D50}\ - \{2227A280-3AEA-1069-A2DE-08002B30309D}\ - \{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\ - \{AA509086-5Ca9-4C25-8F95-589D3C07B48A}\ selection_susp_location_1: Details|contains: - :\Perflogs\ - \AppData\Local\ - \Desktop\ - \Downloads\ - \Microsoft\Windows\Start Menu\Programs\Startup\ - \System32\spool\drivers\color\ - \Temporary Internet - \Users\Public\ - \Windows\Temp\ - '%appdata%' - '%temp%' - '%tmp%' selection_susp_location_2: - Details|contains|all: - :\Users\ -
Near-miss passage: Sigma rule: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker try. Logsource: windows / registry_delete. Rule: title: Folder Removed From Exploit Guard ProtectedFolders List - Registry id: 272e55a4-9e6b-4211-acb6-78f51f0b1b40 status: test description: Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-02-08 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders condition: selection falsepositives: - Legitimate administrators removing applications (should always be investigated) level: high