PowerShell Execute COM Object

This analytic detects the execution of a COM CLSID through PowerShell. It specifically looks for PowerShell script block logs (EventCode 4104) containing the string "*CreateInstance([type]::GetTypeFromCLSID*". This activity is significant because adversaries and malware, such as Conti ransomware, commonly use COM object creation via PowerShell for purposes like privilege escalation or bypassing User Account Control (UAC). Successful exploitation of this technique could lead to elevated privileges or persistence within the environment, posing a significant security risk.