Techniques › T1559 › T1559.001
T1559.001 Component Object Model
execution — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
4
Sigma rules tagged attack.t1559.001
0
KEV CVEs mapped here
<p>Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).</p><p>Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic. Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0224 Detect Abuse of Component Object Model (T1559.001) v1.0
AN0628 WindowsDetects anomalous use of COM objects for execution, such as Office applications spawning scripting engines, enumeration of COM interfaces via registry queries, or processes loading atypical DLLs through COM activation. Correlates process creation, module loads, and registry queries to flag suspicious COM-based code execution or persistence.Tunable:
COMObjectAllowListParentProcessExclusionsTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1559.001
Author: Dmitriy Lifanov, oscd.community
· 2019-10-25 (modified 2023-09-18) · logsource: product=windows category=dns_query · 36e037c4-c228-4866-b6a3-48eb292b9955
Detects DNS queries initiated by "Regsvr32.exe"
Author: Nik Seetharaman
· 2018-07-16 (modified 2021-06-27) · logsource: product=windows category=process_access · 3b4b232a-af90-427c-a22f-30b0c0837b95
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Author: Dmitriy Lifanov, oscd.community
· 2019-10-25 (modified 2023-09-18) · logsource: product=windows category=network_connection · c7e91a02-d771-4a6d-a700-42587e0b1095
Detects a network connection initiated by "Regsvr32.exe"
Author: bartblaze
· 2020-07-13 (modified 2024-07-16) · logsource: product=windows category=network_connection · cfed2f44-16df-4bf3-833a-79405198b277
Detects Dllhost.EXE initiating a network connection to a non-local IP address.
Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL.
An initial baseline is recommended before deployment.
Rules tagged at the parent level (attack.t1559) 1
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2020-11-26 (modified 2021-11-27) · logsource: product=windows category=process_creation · 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"