Verclsid.exe Runs COM Object via GUID

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•17

Detects when 'verclsid.exe', a legitimate Windows binary, is used to execute a COM object via its GUID. This technique is often leveraged by adversaries for defense evasion and to bypass application control mechanisms by proxying execution through a trusted system binary.