Suspicious GetTypeFromCLSID ShellExecute in PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•5•0•16

Detects PowerShell code that uses `GetTypeFromCLSID` in conjunction with `.ShellExecute(` to execute COM objects. This technique can be used for persistence or privilege escalation by adversaries.