COM Hijacking via TreatAs

Title: COM Hijacking via TreatAs
Status: test
Description:Detect modification of TreatAs key to enable "rundll32.exe -sta" command
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
  -https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s
Author: frack113
Date: 2022-08-28
modified:2025-07-11
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.015'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: 'TreatAs\(Default)'
  filter_office:
    Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
  filter_office2:
    Image:
      -'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
      -'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'

  filter_svchost:
    Image: 'C:\Windows\system32\svchost.exe'
  filter_misexec:
    Image:
      -'C:\Windows\system32\msiexec.exe'
      -'C:\Windows\SysWOW64\msiexec.exe'

  condition:selection and not 1 of filter_*
Falsepositives:
  -Legitimate use
Level: medium