UNCanny InstallService StaticPluginMap or HKCU CLSID Registry Hijack

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects suspicious registry writes to HKLM StaticPluginMap or HKCU CLSID entries that could be used to redirect InstallService plugin loading. Adversaries may modify these registry keys to achieve persistence or defense evasion by hijacking the loading of legitimate plugins.