Detection rules › Sigma
COM Hijacking via TreatAs
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Known false positives
- Legitimate use
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule body
title: COM Hijacking via TreatAs
id: dc5c24af-6995-49b2-86eb-a9ff62199e82
status: test
description: Detect modification of TreatAs key to enable "rundll32.exe -sta" command
references:
- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
- https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s
author: frack113
date: 2022-08-28
modified: 2025-07-11
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.015
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: 'TreatAs\(Default)'
filter_office:
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|endswith: '\OfficeClickToRun.exe'
filter_office2:
Image:
- 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
- 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
filter_svchost:
# Example of target object by svchost
# TargetObject: HKLM\SOFTWARE\Microsoft\MsixRegistryCompatibility\Package\Microsoft.Paint_11.2208.6.0_x64__8wekyb3d8bbwe\User\SOFTWARE\Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs\(Default)
# TargetObject: HKU\S-1-5-21-1000000000-000000000-000000000-0000_Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs\(Default)
Image: 'C:\Windows\system32\svchost.exe'
filter_misexec:
# This FP has been seen during installation/updates
Image:
- 'C:\Windows\system32\msiexec.exe'
- 'C:\Windows\SysWOW64\msiexec.exe'
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate use
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
TargetObject|endswith: 'TreatAs\(Default)'
Stage 2: not filter_*
filter_office:
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|endswith: '\OfficeClickToRun.exe'
filter_office2:
Image:
- 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
- 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
filter_svchost:
Image: 'C:\Windows\system32\svchost.exe'
filter_misexec:
Image:
- 'C:\Windows\system32\msiexec.exe'
- 'C:\Windows\SysWOW64\msiexec.exe'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \OfficeClickToRun.exe | excludes:Image field:"Image" value:"\OfficeClickToRun.exe" |
Image | starts_with | C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ | excludes:Image field:"Image" value:"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\" |
Image | eq | C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe | excludes:Image field:"Image" value:"C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe" |
Image | eq | C:\Program Files\Microsoft Office\root\integration\integrator.exe | excludes:Image field:"Image" value:"C:\Program Files\Microsoft Office\root\integration\integrator.exe" |
Image | eq | C:\Windows\SysWOW64\msiexec.exe | excludes:Image field:"Image" value:"C:\Windows\SysWOW64\msiexec.exe" |
Image | eq | C:\Windows\system32\msiexec.exe | excludes:Image field:"Image" value:"C:\Windows\system32\msiexec.exe" |
Image | eq | C:\Windows\system32\svchost.exe | excludes:Image field:"Image" value:"C:\Windows\system32\svchost.exe" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | ends_with |
| field:"TargetObject" kind:ends_with value:"TreatAs\(Default)" |