Verclsid COM Object Proxy Execution Payload

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects HTTP requests containing 'verclsid' and '/S' in the URI, which is indicative of the Verclsid COM Object Proxy Execution technique (T1218.012). This technique is often used by attackers for defense evasion by executing arbitrary commands or binaries through a COM object.