Medusa GroupG1051 ↗
Has leveraged Component Object Model (COM) to bypass UAC.1
tfMITRE ATT&CK sub-technique
Component Object Model T1559.001
sub-technique of T1559 Inter-Process Communication
- Tactic
- Execution
- Platform
- Windows
- Version
- 1.2
- Created
- 12 February 2020
- Last modified
- 12 May 2026
Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.[1] Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).[2] Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.18
Tools & malwareTop 19%
Tools & malware81st percentile · 81% of ATT&CK techniques have this many tools implementing them or fewer.5
Detection rules64th pct
Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.Component Object Model MITRE reference T1559.001
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
KimsukyG0094 ↗
Has leveraged Component Object Model (COM) to create scheduled tasks to include using naming conventions that mimic legitimate applications.1 Kimsuky has leveraged obfuscation VBScript to form a string in WScript.Shell which has downloaded a malicious payload to the victim environment.2
MuddyWaterG0069 ↗
Has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.123
Gamaredon GroupG0047 ↗
Malware can insert malicious macros into documents using a Microsoft.Office.Interop object.12
All 4 groups for this technique
18 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
RustyWaterS9037 ↗
Has used a WScript.Shell COM object to execute the CertificationKit.ini file.1
STATICPLUGINS1238 ↗
Has utilized Windows COM Installer Object to download an MSI package containing files masqueraded as a BMP file.1
CLAIMLOADERS1236 ↗
Has leveraged Component Object Model (COM) objects to create a scheduled task using ITaskService interface.1
LatrodectusS1160 ↗
Can use the Windows Component Object Model (COM) to set scheduled tasks.12
Raspberry RobinS1130 ↗
Creates an elevated COM object for CMLuaUtil and uses this to set a registry value that points to the malicious LNK file during execution.1
DarkTortillaS1066 ↗
Has used the WshShortcut COM object to create a .lnk shortcut file in the Windows startup folder.1
All 18 software entries for this technique · 6 newest in this preview
Offense vs defense T1559.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1
first rule: 2018 Q3Component Object Model detection strategy DET0224
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Abuse of Component Object Model (T1559.001)
1 platform
AN0628 · Windows
Detects anomalous use of COM objects for execution, such as Office applications spawning scripting engines, enumeration of COM interfaces via registry queries, or processes loading atypical DLLs through COM activation. Correlates process creation, module loads, and registry queries to flag suspicious COM-based code execution or persistence.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Windows Registry Key AccessDC0050 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| COMObjectAllowList | Legitimate COM CLSIDs and ProgIDs used by enterprise applications, to reduce false positives. |
| ParentProcessExclusions | Expected parent-child process relationships (e.g., explorer.exe spawning dllhost.exe). |
| TimeWindow | Threshold for correlating COM object execution with subsequent process creation or DLL load. |
Ensure all COM alerts and Protected View are enabled.
Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.
Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.