Potential PSFactoryBuffer COM Hijacking
Detects changes to the PSFactory COM InProcServer32 registry key, specifically targeting the CLSID {c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}. This technique has been observed being used by the RomCom threat actor to establish persistence by storing a malicious DLL, replacing the legitimate ActXPrxy.dll.
Sigma
