ForumTroll COM Hijacking Persistence

Tim Peck@timpeck

•updated Dec 17, 2025•5•0•68

Detects a specific COM hijacking technique used by the ForumTroll APT group for persistence. This rule identifies registry modifications to the CLSID {1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}, which the group has reused across campaigns.