Detection rules › Kusto Query Language

Component Object Model Hijacking - Vault7 trick

Source: upstream

This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546.015` Event Triggered Execution: Component Object Model Hijacking
Privilege Escalation	`T1546.015` Event Triggered Execution: Component Object Model Hijacking

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)
Security-Auditing	4657	A registry value was modified.
Defender-DeviceRegistryEvents	9005003	Registry value set

Stages and Predicates

Stage 1: `source`

DeviceRegistryEvents

Stage 2: `where`

and
  ActionType eq "RegistryValueSet"
  RegistryKey match "ShellFolder"
  RegistryValueName eq "Attributes"

Stage 3: `where`

 macro "(toint(RegistryValueData) >= int(4035969341))"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`ActionType`	eq	`RegistryValueSet`
`RegistryKey`	match	`ShellFolder`
`RegistryValueName`	eq	`Attributes`