COM Object Hijacking Via Modification Of Default System CLSID Default Value

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•15

Detects potential COM object hijacking by monitoring modifications to the default values of InprocServer32 or LocalServer32 subkeys within specific CLSIDs in the Windows Registry. The rule specifically looks for these modifications occurring in suspicious file system locations commonly used by adversaries for persistence or staging.