PowerShell COM database enumeration via OleViewDotNet/NtObjectManager

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

This rule detects suspicious PowerShell activity involving the enumeration and manipulation of COM objects and .NET assemblies, patterns often associated with reconnaissance or post-exploitation activities. It flags instances where PowerShell scripts utilize specific command-line arguments (e.g., Get-ComDatabase, Get-ComClass, Import-Win32Module, NtObjectManager) in conjunction, suggesting automated discovery of COM infrastructure or assembly loading.