COM Hijacking via TreatAs Registry Key Modification
Detects modifications to the 'TreatAs' registry key, which can be used for COM Hijacking. This technique allows an attacker to substitute a legitimate COM object with a malicious one, often used for persistence or privilege escalation, particularly when combined with commands like "rundll32.exe -sta". The rule includes filters for common legitimate processes that might modify this key, such as Microsoft Office components, svchost.exe, and msiexec.exe during installations or updates.
Sigma
