Tony M Lambert
c3b398e48c
* Revert "Add Dependencies section to test Yaml and support to use them in the PS execution framework (#772)"
This reverts commit 511bb87af2.
* Generate docs from job=validate_atomics_generate_docs branch=revert-511bb87af29fb302dbd9e85bd93c2c00a47953ba
1.5 KiB
1.5 KiB
T1122 - Component Object Model Hijacking
Description from ATT&CK
The Component Object Model (COM) is a system within Windows to enable interaction between software components through the operating system. (Citation: Microsoft Component Object Model) Adversaries can use this system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Windows Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. (Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.
Atomic Tests
Atomic Test #1 - Component Object Model Hijacking
Hijack COM Object used by certutil.exe
Supported Platforms: Windows
Run it with command_prompt!
reg import PathToAtomicsFolder\T1122\src\COMHijack.reg
certutil.exe -CAInfo
Cleanup Commands:
reg import PathToAtomicsFolder\T1122\src\COMHijackCleanup.reg