Potential Persistence Via Scrobj.dll COM Hijacking

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•12

This rule detects potential persistence via Component Object Model (COM) hijacking by monitoring modifications to the Windows Registry. Specifically, it looks for changes where the 'InprocServer32\(Default)' key is set to 'C:\WINDOWS\system32\scrobj.dll'. Adversaries can abuse scrobj.dll, which looks for the 'ScriptletURL' key to execute scripts, to maintain persistence on a system.