Potential COM Objects Download Cradles Usage - PS Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the usage of COM objects that can be abused to download files within PowerShell scripts by identifying specific CLSIDs. This technique is often used by adversaries for ingress tool transfer or to establish command and control.