Argamal RAT COM Hijacking via HKCU CLSID InprocServer32 Registry Modification

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects modifications to COM InprocServer32 registry keys under HKEY_CURRENT_USER. This activity is often associated with COM hijacking, a technique used by adversaries to achieve persistence or execute malicious code when a hijacked COM object is invoked by legitimate applications. The rule specifically flags suspicious or non-Microsoft COM registrations, particularly those pointing to files within the user's AppData/Local directory.