Component Object Model Hijacking - Vault7 trick

id: 1aaff41f-4e18-45b1-bb34-de6eb4943cf2
name: Component Object Model Hijacking - Vault7 trick
description: |
  This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. 
  The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value. 
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceRegistryEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1546.015
query: |
  DeviceRegistryEvents
  | where RegistryKey has "ShellFolder"  and ActionType =~ "RegistryValueSet" and RegistryValueName =~ "Attributes" 
  // toint automatically converts base10 and base16 strings to int toint("0xFF") == toint("255") == int(0xFF) ==  int(255).
  // We are using >= to make sure that if someone adds an additional flag to this field, it doesn't bypass this hunt.
  // Removing any flag will bypass this hunt, but more research is needed to understand which of the flag values are relevant.
  | where toint(RegistryValueData) >= int(0xf090013d) 
  //UPDATE: Flag details are here: https://medium.com/falconforce/introducing-falcon-friday-1f972d65ce1b?source=friends_link&sk=e48d9cb974e216cc4b9b61945a3b177d
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Account
    fieldMappings:
      - identifier: Sid
        columnName: AccountSid 
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled