COM Object Hijack via Registry Modification

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects network traffic containing the string "HKCU\\Software\\Classes\\CLSID" on TCP port 135 (DCE/RPC) directed towards the home network. This pattern is indicative of an attempt to modify registry keys related to COM objects, which can be used for persistence or privilege escalation by hijacking COM object execution.