security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Tuning] Component Object Model Hijacking (#5651)

Browse Source 
* Update persistence_suspicious_com_hijack_registry.toml

* Update persistence_suspicious_com_hijack_registry.toml
This commit is contained in:
Samirbous
2026-02-04 13:23:40 +00:00
committed by GitHub
parent ed089d5d76
commit d42ebdc3e6
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/persistence_suspicious_com_hijack_registry.toml
+3 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/18"
integration = ["endpoint"]
maturity = "production"
updated_date = "2024/09/05"
updated_date = "2026/01/29"
[rule]
author = ["Elastic"]
@@ -98,7 +98,8 @@ registry where host.os.type == "windows" and event.type == "change" and
"HKEY_USERS\\*\\LocalServer32\\",
"HKEY_USERS\\*\\DelegateExecute",
"HKEY_USERS\\*\\TreatAs\\",
"HKEY_USERS\\*\\ScriptletURL*"
"HKEY_USERS\\*\\ScriptletURL*",
"HKEY_USERS\\*\\TypeLib*\\Win*"
) and
not registry.data.strings : (
/* COM related to Windows Spotlight feature */