APT28 Phantom Net Voxel - COM Hijack prnfldr.dll CLSID_Printers
This rule detects potential COM hijacking activity associated with APT28's Phantom Net Voxel operation. Specifically, it looks for command-line executions that involve the CLSID_Printers identifier ('2227A280-3AEA-1069-A2DE-08002B30309D') or the 'prnfldr.dll' file, particularly when 'regsvr32' is used. The detection is contextualized by checking if the process originates from common Microsoft Office applications (WINWORD.EXE, EXCEL.EXE) or script hosts (wscript.exe, cscript.exe), indicating a potential initial access vector or execution from a malicious macro.
Sigma
