Detection rules › Kusto
Component Object Model Hijacking - Vault7 trick
This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
| Privilege Escalation | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
Event coverage
| Provider | Event/ActionType | Title |
|---|---|---|
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Security-Auditing | Event ID 4657 | A registry value was modified. |
| Defender-DeviceRegistryEvents | RegistryValueSet | Registry value set |
Rule body kusto
id: 1aaff41f-4e18-45b1-bb34-de6eb4943cf2
name: Component Object Model Hijacking - Vault7 trick
description: |
This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method.
The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- DeviceRegistryEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
- PrivilegeEscalation
relevantTechniques:
- T1546.015
query: |
DeviceRegistryEvents
| where RegistryKey has "ShellFolder" and ActionType =~ "RegistryValueSet" and RegistryValueName =~ "Attributes"
// toint automatically converts base10 and base16 strings to int toint("0xFF") == toint("255") == int(0xFF) == int(255).
// We are using >= to make sure that if someone adds an additional flag to this field, it doesn't bypass this hunt.
// Removing any flag will bypass this hunt, but more research is needed to understand which of the flag values are relevant.
| where toint(RegistryValueData) >= int(0xf090013d)
//UPDATE: Flag details are here: https://medium.com/falconforce/introducing-falcon-friday-1f972d65ce1b?source=friends_link&sk=e48d9cb974e216cc4b9b61945a3b177d
entityMappings:
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: DeviceName
- entityType: Account
fieldMappings:
- identifier: Sid
columnName: AccountSid
- identifier: Name
columnName: AccountName
- identifier: NTDomain
columnName: AccountDomain
- entityType: Process
fieldMappings:
- identifier: CommandLine
columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
DeviceRegistryEvents
Stage 2: where
| where RegistryKey has "ShellFolder" and ActionType =~ "RegistryValueSet" and RegistryValueName =~ "Attributes"
Stage 3: where
| where toint(RegistryValueData) >= int(0xf090013d)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ActionType | eq |
|
RegistryKey | match |
|
RegistryValueData | ge |
|
RegistryValueName | eq |
|