T1559.001 — Component Object Model

Tactic: Execution · Platforms: Windows

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or…

Sub-technique of Inter-Process Communication (T1559).

Sigma detection rules (1)

T1559.001 Inter-Process Communication: Component Object Model

title: "T1559.001 Inter-Process Communication: Component Object Model"
id: dc4d4e58-d820-4ef1-ba4b-e5634ed5ad4e
description: 'Detect Abuse of Component Object Model (T1559.001). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: COMObjectAllowList, ParentProcessExclusions, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1559/001
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.execution
  - attack.t1559.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    ParentImage|endswith: '\svchost.exe'
    CommandLine|contains: '-Embedding'

  filter_common_paths:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
      - 'C:\Windows\'

  condition: selection and not filter_common_paths

falsepositives:
  - Many legitimate COM servers (OneDrive, browsers, Office add-ins) self-register via -Embedding from standard install paths.

level: medium

Related sub-techniques

Explore