
title: Windows Registry Persistence COM Key Linking
author: Kutepov Anton, oscd.community
date: 2019/10/23
description: Detects COM object hijacking via TreatAs subkey
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    EventType: CreateKey
  SELECTION_5:
    TargetObject: '*HKU\\*'
  SELECTION_6:
    TargetObject: '*Classes\CLSID\\*'
  SELECTION_7:
    TargetObject: '*\TreatAs*'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5
    and SELECTION_6 and SELECTION_7)
falsepositives:
- Maybe some system utilities in rare cases use linking keys for backward compatibility
id: 9b0f8a61-91b2-464f-aceb-0527e0a45020
level: medium
logsource:
  category: registry_event
  product: windows
modified: 2021/09/17
references:
- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
status: experimental
tags:
- attack.persistence
- attack.t1122
- attack.t1546.015
ruletype: SIGMA
