COM to .NET Redirection via Registry


Description

Identifies a registry modification that tricks the system into treating a legacy COM class as a .NET System.Object, effectively bridging the native and managed worlds as a preparation for .NET code injection.

Query · eql

registry where event.type == "change" and
 registry.path : "HKLM\\SOFTWARE\\Classes\\CLSID\\{*}\\TreatAs\\" and registry.data.strings : "{81C5FE01-027C-3E1C-98D5-DA9C9862AA21}"
Raw source COM to .NET Redirection via Registry · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Identifies a registry modification that tricks the system into treating a legacy COM class as a .NET System.Object,
effectively bridging the native and managed worlds as a preparation for .NET code injection.
"""
id = "bc5df38d-b529-40c8-8f4e-6092b0efe384"
license = "Elastic License v2"
name = "COM to .NET Redirection via Registry"
os_list = ["windows"]
reference = [
    "https://mohamed-fakroud.gitbook.io/red-teamings-dojo/abusing-idispatch-for-trapped-com-object-access-and-injecting-into-ppl-processes",
    "https://github.com/T3nb3w/ComDotNetExploit",
]
version = "1.0.3"

query = '''
registry where event.type == "change" and
 registry.path : "HKLM\\SOFTWARE\\Classes\\CLSID\\{*}\\TreatAs\\" and registry.data.strings : "{81C5FE01-027C-3E1C-98D5-DA9C9862AA21}"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.015"
name = "Component Object Model Hijacking"
reference = "https://attack.mitre.org/techniques/T1546/015/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.