COM object hijack
A COM class was redefined in the per-user registry.
What it detects
A COM class was redefined in the per-user registry. Windows resolves a CLSID by checking HKCU\Software\Classes BEFORE HKLM, so an unprivileged user can point an existing, widely-used COM object at their own DLL. Every application that later instantiates that class loads the attacker's code — inside a trusted, signed process, with no autostart entry and no new binary on disk.
TreatAs is the stronger of the two signals: it forwards one CLSID wholesale to another, and has essentially no legitimate per-user use. Turla's Outlook backdoor is the well-documented example, hijacking a mail COM object so the payload loads inside Outlook itself.
MITRE ATT&CK mapping
- T1546.015Event Triggered Execution: Component Object Model Hijacking· Persistence
False positives and triage
Per-user COM registration is legitimate — software installed without administrator rights registers its own classes this way, and .NET and Office add-ins do it routinely. Volume alone is not the signal.
To confirm: take the CLSID and look it up under HKLM\SOFTWARE\Classes\CLSID. If it ALREADY exists machine-wide, the per-user entry is an override of an existing object and that is the hijack; if it exists only under HKCU, it is probably a genuine per-user install. Then read the DLL path in Details= — a legitimate registration points into the application's own install directory, not \Temp\, \ProgramData\ or a user profile. Any TreatAs value should be treated as suspicious regardless.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/com_object_hijack.yaml, licensed under the Apache License 2.0.
id: windows.persistence.com_object_hijack
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1546.015]
description: |
A COM class was redefined in the per-user registry. Windows resolves a CLSID by
checking `HKCU\Software\Classes` BEFORE `HKLM`, so an unprivileged user can point
an existing, widely-used COM object at their own DLL. Every application that later
instantiates that class loads the attacker's code — inside a trusted, signed
process, with no autostart entry and no new binary on disk.
`TreatAs` is the stronger of the two signals: it forwards one CLSID wholesale to
another, and has essentially no legitimate per-user use. Turla's Outlook backdoor
is the well-documented example, hijacking a mail COM object so the payload loads
inside Outlook itself.
match:
# The hive is the whole point and must be anchored. Machine-wide registration under
# HKLM\SOFTWARE\Classes is what every legitimate installer writes; the hijack works
# precisely because the PER-USER store is consulted first, and only a per-user entry
# is writable without elevation.
#
# Both per-user renderings are matched: `HKCU\Software\Classes\...`, and the form
# Sysmon actually emits, `HKU\<SID>_Classes\...` — which has NO separator before
# `_Classes`, so a rule anchored on a backslash alone misses every real event.
registry_path_regex: '(?i)(hkcu\\software\\classes|hku\\[^\\]+_classes)\\clsid\\\{[0-9a-f-]{36}\}\\(inprocserver32|localserver32|treatas)'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Per-user COM registration is legitimate — software installed without administrator
rights registers its own classes this way, and .NET and Office add-ins do it
routinely. Volume alone is not the signal.
To confirm: take the CLSID and look it up under `HKLM\SOFTWARE\Classes\CLSID`. If
it ALREADY exists machine-wide, the per-user entry is an override of an existing
object and that is the hijack; if it exists only under HKCU, it is probably a
genuine per-user install. Then read the DLL path in `Details=` — a legitimate
registration points into the application's own install directory, not `\Temp\`,
`\ProgramData\` or a user profile. Any `TreatAs` value should be treated as
suspicious regardless.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.