TWINLOOT TypeLib COM Hijack Scriptlet and UserExperienceSync Run Key Persistence

Duo Tech@duotech

•updated Aug 20, 2026•7•0•8

Detects TWINLOOT persistence mechanisms observed in the TWINLOOT Python implant framework, including COM hijacking via a scriptlet (.sct) reference written to the TypeLib registry key for CLSID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} version 1.1 (win32/win64), and the creation of a Run key value named 'UserExperienceSync' under CurrentVersion\Run for autorun persistence.