DLL Planted at Dangling CrossDevice COM Path in ProgramData

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•7

This rule detects the creation or modification of a DLL file within the 'ProgramData\CrossDevice' directory, or the modification of a specific COM CLSID InprocServer32 registry key associated with 'CrossDevice.Streaming.Source.dll'. This behavior is indicative of potential COM hijacking or persistence mechanisms targeting the CrossDevice streaming framework.