[rule]
description = """
Identifies a registry modification that tricks the system into treating a legacy COM class as a .NET System.Object,
effectively bridging the native and managed worlds as a preparation for .NET code injection.
"""
id = "bc5df38d-b529-40c8-8f4e-6092b0efe384"
license = "Elastic License v2"
name = "COM to .NET Redirection via Registry"
os_list = ["windows"]
reference = [
"https://mohamed-fakroud.gitbook.io/red-teamings-dojo/abusing-idispatch-for-trapped-com-object-access-and-injecting-into-ppl-processes",
"https://github.com/T3nb3w/ComDotNetExploit",
]
version = "1.0.3"
query = '''
registry where event.type == "change" and
registry.path : "HKLM\\SOFTWARE\\Classes\\CLSID\\{*}\\TreatAs\\" and registry.data.strings : "{81C5FE01-027C-3E1C-98D5-DA9C9862AA21}"
'''
min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.015"
name = "Component Object Model Hijacking"
reference = "https://attack.mitre.org/techniques/T1546/015/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"