Detection: Windows COM Hijacking InprocServer32 Modification
Description
The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which may be related to COM hijacking. Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
Annotations
No annotations available.
Implementation
To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
Known False Positives
False positives may be present and some filtering may be required.
Associated Analytic Story
Risk Based Analytics (RBA)
| Risk Message | Risk Score | Impact | Confidence |
|---|---|---|---|
| An instance of $parent_process_name$ has spawned $process_name$ attempting to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$. | 64 | 80 | 80 |
References
Version: 4