Per-user COM hijacking via HKCU CLSID InProcServer32 to AppData

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•5

Detects the modification of registry keys under HKCU\Software\Classes\CLSID\...\InProcServer32, which is a common method for achieving persistence. The rule flags when these registry keys point to file paths within the local user profile (AppData), which is frequently used by malicious actors to load custom DLLs when the corresponding COM object is initialized.