Cross-source coverage
T1218.012 / ATT&CK
System Binary Proxy Execution: Verclsid
3 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.
Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to Regsvr32). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:Sysmon
How MITRE says to detect it DET0042
Detection Strategy for T1218.012 Verclsid Abuse
Windows Analytic 0118
Detects abuse of verclsid.exe to execute COM objects by monitoring process creation, CLSID arguments, DLLs or scriptlet engines loaded into memory, and If the CLSID points to remote SCT/HTA content, verclsid.exe makes outbound connections.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=13, 14WinEventLog:SysmonEventCode=3, 22
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| Office application invoked Verclsid.exe, possible COM payload execution | High | Wazuh XML |
| Verclsid.exe may have been used to execute COM payload | High | Wazuh XML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Verclsid CLSID Execution | Undefined | SPL |