Argamal RAT COM Hijacking via HKCU CLSID InprocServer32 Registry Write
Detects the modification or creation of registry keys related to COM InprocServer32 within the HKEY_CURRENT_USER hive, specifically pointing to executable or library files residing within the user's AppData/Local directory. This technique is commonly used by adversaries for persistence by hijacking COM objects to execute malicious code when legitimate software invokes the hijacked component.
Microsoft Sentinel (KQL)
