Situational AwarenessCAR-2020-09-002

Component Object Model Hijacking

Hypothesis and description

Adversaries may establish persistence or escalate privileges by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. This is typically done by replacing COM object registry entries under the HKEY_CURRENT_USER\Software\Classes\CLSID or HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID keys. Accordingly, this analytic looks for any changes under these keys.

Platforms: Windows
Domain: Host
Subtypes: Registry
Submitted: 2020-09-10
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1546 Event Triggered ExecutionT1546.015	Persistence, Privilege Escalation	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1546Event Triggered Execution
.015 Component Object Model Hijacking

D3FEND techniques MITRE maps to this analytic

D3-SICA System Init Config Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - COM object registry entry modificationData model: CAR native

This is a pseudocode representation of the below splunk search.

registry_keys = search (Registry:Create AND Registry:Remove AND Registry:Edit)
clsid_keys = filter registry_keys where (
  key = "*\Software\Classes\CLSID\*")
output clsid_keys

SplunkSplunk search - COM object registry entry modificationData model: Sysmon native

This Splunk search looks for any registry keys that were created, deleted, or renamed, as well as any registry values that were set or renamed under the Windows COM Object registry key.

index=__your_sysmon_index__ (EventCode=12 OR EventCode=13 OR EventCode=14) TargetObject="*\\Software\\Classes\\CLSID\\*"

LogPointLogPoint search - COM object registry entry modificationData model: LogPoint native

This LogPoint search looks for any registry keys that were created, deleted, or renamed, as well as any registry values that were set or renamed under the Windows COM Object registry key.

norm_id=WindowsSysmon event_id IN [12, 13, 14] target_object="*\Software\Classes\CLSID\*"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

38 more in the full list

View CAR-2020-09-002 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1546 Event Triggered ExecutionT1546.015

Persistence, Privilege Escalation

Moderate