UNCanny Add-Type COM Interop for InstallService API Access via PowerShell

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.