COM Object Hijacking via HKCU Registry Modification

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects modifications to COM object registration keys under HKEY_CURRENT_USER (HKCU) which can be used to hijack COM objects for persistence. The rule monitors for the creation or modification of InProcServer32 or LocalServer32 values, while excluding common system paths to reduce noise.