Deletion of COM Hijacking Registry Keys
Detects the deletion of registry entries within the `.*\shell\open\command` keys. This activity is often associated with COM hijacking, where an attacker modifies these keys to execute their malicious code instead of legitimate applications. The deletion of these keys could indicate an adversary attempting to remove traces of their COM hijacking activities.
Sigma
