COM Hijacking Persistence via CLSID InprocServer32 Modification

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects modifications or creation of InprocServer32 COM registry keys by suspicious processes like mshta.exe or powershell.exe, which is indicative of COM Hijacking for persistence or privilege escalation.