Potential PSFactoryBuffer COM Hijacking

Title: Potential PSFactoryBuffer COM Hijacking
Status: test
Description:Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
References:
  -https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
  -https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html
  -https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection
  -https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html
Author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
Date: 2023-06-07
modified:2023-08-17
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.015'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'
  filter_main:
    Details:
      -'%windir%\System32\ActXPrxy.dll'
      -'C:\Windows\System32\ActXPrxy.dll'

  condition:selection and not filter_main
Falsepositives:
  -Unknown
Level: high