T1546.015 — Component Object Model Hijacking

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.015 Event Triggered Execution: Component Object Model Hijacking

title: "T1546.015 Event Triggered Execution: Component Object Model Hijacking"
id: dcefb8d5-9964-47b1-a959-08071611c72a
description: 'Windows COM Hijacking Detection via CLSID InprocServer32/LocalServer32/TreatAs Registry Key Modification. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: RegistryPathScope, BinaryPathAnomalyThreshold, TimeWindow, UserContextFilter.'
references:
  - https://attack.mitre.org/techniques/T1546/015
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.015

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection_clsid:
    EventID: '13'
    TargetObject|contains: '\Software\Classes\CLSID\'
  selection_subkey:
    TargetObject|contains:
      - '\InprocServer32'
      - '\LocalServer32'
      - '\TreatAs'
      - '\ScriptletURL'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_clsid and selection_subkey and not filter_system_account

falsepositives:
  - Legitimate software installers registering/updating COM servers during install/upgrade.

level: medium

Related sub-techniques

Explore