Windows Color System COM Hijack

Duo Tech@duotech

•updated Jun 3, 2026•0•0•4

Detects modification of the InprocServer32 key for the Windows Color System Calibration CLSID, a persistence mechanism actively abused by the Argamal RAT to establish startup persistence tied to user login via a default Windows scheduled task.