Potential PSFactoryBuffer COM Hijacking

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.