Potential COM Object Hijacking Via TreatAs Subkey - Registry

Title: Potential COM Object Hijacking Via TreatAs Subkey - Registry
Status: test
Description:Detects COM object hijacking via TreatAs subkey
References:
  -https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
Author: Kutepov Anton, oscd.community
Date: 2019-10-23
modified:2025-10-26
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.015'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains|all:
      -'HKU\'
      -'Classes\CLSID\'
      -'\TreatAs'

  filter_main_svchost:
    Image: 'C:\WINDOWS\system32\svchost.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Maybe some system utilities in rare cases use linking keys for backward compatibility
Level: medium