Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
160 detections
Filters
Last updated
All Time
Detection languages
68
58
9
8
6
Contributors
35
31
21
19
13
Categories
77
47
32
25
23
Platforms
156
1
1
1
Products / Services
58
43
17
9
4
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
7
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the modification of specific CLSID registry keys related to the .NET NGEN scheduled task. This Component Object Model (COM) hijacking technique is used by the threat actor 'Curly COMrades' to establish persistence for their 'MucorAgent' backdoor.
Detects the deletion of registry entries within the `.*\shell\open\command` keys. This activity is often associated with COM hijacking, where an attacker modifies these keys to execute their malicious code instead of legitimate applications. The deletion of these keys could indicate an adversary attempting to remove traces of their COM hijacking activities.
Detects potential COM object hijacking by monitoring modifications to the default values of InprocServer32 or LocalServer32 subkeys within specific CLSIDs in the Windows Registry. The rule specifically looks for these modifications occurring in suspicious file system locations commonly used by adversaries for persistence or staging.
Detects potential COM object hijacking attempts by monitoring the creation of 'TreatAs' subkeys within the HKU (HKEY_USERS) hive. Adversaries can manipulate the Windows Component Object Model (COM) registry structure to redirect legitimate COM object calls to malicious code, achieving persistence or privilege escalation. This rule specifically looks for the creation of a 'TreatAs' subkey under a CLSID (Class ID) entry, which is a known method for COM hijacking. The rule filters out creations by 'svchost.exe' to reduce false positives, as svchost can legitimately create such keys.
This rule detects potential persistence mechanisms leveraging the Appx DebugPath feature in Windows. Adversaries can modify specific registry keys related to Universal Windows Platform (UWP) applications to inject a malicious DebugPath, which then executes their code when the associated application is launched. The rule specifically looks for modifications to the 'DebugPath' value within 'Classes\ActivatableClasses\Package\Microsoft.' registry paths or the default value within '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.' paths.
Detects changes to the PSFactory COM InProcServer32 registry key, specifically targeting the CLSID {c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}. This technique has been observed being used by the RomCom threat actor to establish persistence by storing a malicious DLL, replacing the legitimate ActXPrxy.dll.
This rule detects potential persistence via Component Object Model (COM) hijacking by monitoring modifications to the Windows Registry. Specifically, it looks for changes where the 'InprocServer32\(Default)' key is set to 'C:\WINDOWS\system32\scrobj.dll'. Adversaries can abuse scrobj.dll, which looks for the 'ScriptletURL' key to execute scripts, to maintain persistence on a system.
Detects modifications to the 'TreatAs' registry key, which can be used for COM Hijacking. This technique allows an attacker to substitute a legitimate COM object with a malicious one, often used for persistence or privilege escalation, particularly when combined with commands like "rundll32.exe -sta". The rule includes filters for common legitimate processes that might modify this key, such as Microsoft Office components, svchost.exe, and msiexec.exe during installations or updates.
Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious, publicly writable locations. This activity could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking, abusing the BDEUILauncher Class to execute code in the logged-on user's session without credential theft.
Detects potential persistence using Appx DebugPath
Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
This rule hunts for various artifacts and behaviors associated with the APT28 campaign "Phantom Net Voxel", which leverages COM hijacking, steganography, and cloud services for C2. This version is specifically tailored for Azure Sentinel using only DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents. It detects known malicious file hashes, regsvr32 execution of a specific DLL, Office applications dropping malicious DLLs or steganographic PNGs, C2 communications to known cloud storage domains, creation of SlimAgent log files, and explorer.exe accessing steganographic PNG files indicating successful COM hijacking.
Detects a Component Object Model (COM) TypeLib hijacking persistence technique. This rule identifies modifications to the registry for the 'Microsoft Web Browser' CLSID, where it is altered to point to a malicious scriptlet (.sct) file. This specific method was used by the MixShell malware in the ZipLine campaign to maintain access.
Detects Component Object Model (COM) hijacking used by the Curly COMrades threat actor for persistence. This rule identifies registry modifications that alter specific CLSIDs related to the .NET NGEN task to load the MucorAgent malware.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects MucorAgent, a multi-stage .NET backdoor used by the Curly COMrades threat actor. It uses COM hijacking for persistence and executes AES-encrypted PowerShell scripts.
This KQL detection is designed for use in Microsoft Defender for Endpoint Advanced Hunting or Microsoft Sentinel, depending on table availability.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
Detects potential COM object hijacking via modification of default system CLSID.
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects potential COM object hijacking via modification of default system CLSID.
Page 6 of 8