Per-User COM Hijack via HKCU CLSID InProcServer32 to AppData

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects persistence attempts using Component Object Model (COM) hijacking by modifying HKCU CLSID InProcServer32 registry keys. The rule specifically identifies instances where the registry value points to a DLL file located within the user's AppData or LocalAppData directories, excluding typical system or program directories, as seen in sideloading persistence chains.