Potential COM Object Hijacking via TreatAs Subkey Creation
Detects potential COM object hijacking attempts by monitoring the creation of 'TreatAs' subkeys within the HKU (HKEY_USERS) hive. Adversaries can manipulate the Windows Component Object Model (COM) registry structure to redirect legitimate COM object calls to malicious code, achieving persistence or privilege escalation. This rule specifically looks for the creation of a 'TreatAs' subkey under a CLSID (Class ID) entry, which is a known method for COM hijacking. The rule filters out creations by 'svchost.exe' to reduce false positives, as svchost can legitimately create such keys.
Sigma
