title: Windows Registry Persistence COM Search Order Hijacking
id: a0ff33d8-79e4-4cef-b4f3-9dc4133ccd12
status: experimental
description: Detects potential COM object hijacking leveraging the COM Search Order
references:
    - https://www.cyberbit.com/blog/endpoint-security/com-hijacking-windows-overlooked-security-vulnerability/
    - https://attack.mitre.org/techniques/T1546/015/
author: Maxime Thiebaut (@0xThiebaut), oscd.community, Cédric Hien
date: 2020/04/14
modified: 2022/03/05
tags:
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_event
    product: windows
detection:
    selection: # Detect new COM servers in the user hive
        EventType: SetValue
        TargetObject|startswith: 
            - 'HKCR\CLSID\'
            - 'HKCU\Software\Classes\CLSID\'
        TargetObject|endswith: '\InprocServer32\(Default)'
    filter1:
        Details|contains: # Exclude privileged directories and observed FPs
            - '%%systemroot%%\system32\'
            - '%%systemroot%%\SysWow64\'
    filterOneDrive:
        Details|contains: 
            - '\AppData\Local\Microsoft\OneDrive\'
            - '\FileCoAuthLib64.dll'
            - '\FileSyncShell64.dll'
            - '\FileSyncApi64.dll'
    filter2:
        Details|contains|all:
            - '\AppData\Local\Microsoft\TeamsMeetingAddin\'
            - '\Microsoft.Teams.AddinLoader.dll'
    filter3:
        Details|contains|all:
            - '\AppData\Roaming\Dropbox\'
            - '\DropboxExt64.*.dll'
    filter4:
        Details|endswith: TmopIEPlg.dll #TrendMicro osce
    filter5:
        Image:
            - C:\WINDOWS\system32\wuauclt.exe
            - C:\WINDOWS\system32\svchost.exe
    filter_defender:
        Image|startswith:
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Program Files\Windows Defender\'
        Image|endswith: '\MsMpEng.exe'
    filter_nvidia:
        Details|contains:
            - '\FileRepository\nvmdi.inf'
    filter_edge:
        Image|endswith: '\MicrosoftEdgeUpdateComRegisterShell64.exe'
    filter_dx:
        Image: 'C:\WINDOWS\SYSTEM32\dxdiag.exe'
    filter_python:
        Details:
            - 'C:\Windows\pyshellext.amd64.dll'
            - 'C:\Windows\pyshellext.dll'
    filter_bonjourlib:
        Details:
            - 'C:\Windows\system32\dnssdX.dll'
            - 'C:\Windows\SysWOW64\dnssdX.dll'
    filter_programfiles:
        Details|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_gameservice:
        Details|contains: 'C:\WINDOWS\system32\GamingServicesProxy.dll'
    condition: selection and not 1 of filter*
falsepositives:
    - Some installed utilities (i.e. OneDrive) may serve new COM objects at user-level
level: medium
