Per-User COM Hijacking via HKCU CLSID InProcServer32 to AppData DLL

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•3

Detects the modification of InProcServer32 registry keys within the user's Classes/CLSID hive to point to a file located in the AppData directory. This pattern is commonly used for COM hijacking to achieve persistence or execute arbitrary code under the user's context.