PowerShell scans COM host processes for custom marshaling mitigations
Detects the use of OleViewDotNet or NtObjectManager PowerShell tools to enumerate running COM host processes (e.g., dllhost.exe) and check for the absence of specific security mitigations like EOAC_NO_CUSTOM_MARSHAL or COMGLB_UNMARSHALING_POLICY_STRONG. This behavior is indicative of reconnaissance activity aimed at identifying targets for fake-marshaled CoGetInstanceFromIStorage exploit chains.
Microsoft Sentinel (KQL)
