PowerShell Enumeration of Dangling COM InprocServer32 Registrations

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

This rule detects the use of PowerShell cmdlets often associated with enumerating COM object registrations, specifically targeting 'InProcServer32' registry keys. Such enumeration is a common reconnaissance step for identifying 'dangling' COM objects—registrations that point to missing or non-existent files—which can be exploited to achieve DLL Hijacking or persistence via COM hijacking.