SloppyRAT COM Hijack Persistence via CLSID InprocServer32 Write
Detects the creation or modification of InprocServer32 registry keys within CLSID paths in HKEY_LOCAL_MACHINE. These registry locations are frequently abused by adversaries to achieve persistence or execute arbitrary code (COM hijacking) by pointing the server path to a malicious DLL or executable.
Microsoft Sentinel (KQL)
