ATT&CK technique
View on MITRE ATT&CK →
T1546.015
Component Object Model Hijacking
Privilege EscalationPersistence
14 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Powershell Execute COM Object | production | 2026-10-02 |
| splunk | Powershell COM Hijacking InprocServer32 Modification | production | 2026-10-02 |
| elastic | Component Object Model Hijacking | production | 2026-09-18 |
| elastic | Potential RemoteMonologue Attack | production | 2026-09-18 |
| splunk | Windows COM Hijacking InprocServer32 Modification | production | 2026-05-13 |
| sigma | COM Object Hijacking Via Modification Of Default System CLSID Default Value | experimental | 2025-11-10 |
| sigma | Potential COM Object Hijacking Via TreatAs Subkey - Registry | test | 2025-10-26 |
| sigma | COM Hijacking via TreatAs | test | 2025-07-11 |
| sigma | Potential Persistence Via Scrobj.dll COM Hijacking | test | 2023-08-17 |
| sigma | Potential PSFactoryBuffer COM Hijacking | test | 2023-08-17 |
| sigma | Potential Persistence Using DebugPath | test | 2023-08-17 |
| sigma | Rundll32 Registered COM Objects | test | 2023-02-09 |
| sigma | SOURGUM Actor Behaviours | test | 2022-10-09 |
| sigma | Suspicious GetTypeFromCLSID ShellExecute | test | 2022-04-02 |