detection.wiki

Detection rules › Sigma

Potential PSFactoryBuffer COM Hijacking

Status
test
Severity
high
Log source
product windows, category registry_set
Author
BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
Source
github.com/SigmaHQ/sigma

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.015 Event Triggered Execution: Component Object Model Hijacking
Privilege EscalationT1546.015 Event Triggered Execution: Component Object Model Hijacking

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: Potential PSFactoryBuffer COM Hijacking
id: 243380fa-11eb-4141-af92-e14925e77c1b
status: test
description: Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
references:
    - https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
    - https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html
    - https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection
    - https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html
author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
date: 2023-06-07
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'
    filter_main:
        Details:
            - '%windir%\System32\ActXPrxy.dll'
            - 'C:\Windows\System32\ActXPrxy.dll'
    condition: selection and not filter_main
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not filter_main

Stage 1: selection

selection:
    TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'

Stage 2: not filter_main

filter_main:
    Details:
        - '%windir%\System32\ActXPrxy.dll'
        - 'C:\Windows\System32\ActXPrxy.dll'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Detailseq%windir%\System32\ActXPrxy.dll
DetailseqC:\Windows\System32\ActXPrxy.dll

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectends_with
  • \CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)