Detection rules › Sigma
COM Hijacking via TreatAs
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
| Privilege Escalation | T1546.015 Event Triggered Execution: Component Object Model Hijacking |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
Rule body yaml
title: COM Hijacking via TreatAs
id: dc5c24af-6995-49b2-86eb-a9ff62199e82
status: test
description: Detect modification of TreatAs key to enable "rundll32.exe -sta" command
references:
- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
- https://www.youtube.com/watch?v=3gz1QmiMhss&t=1251s
author: frack113
date: 2022-08-28
modified: 2025-07-11
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.015
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: 'TreatAs\(Default)'
filter_office:
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|endswith: '\OfficeClickToRun.exe'
filter_office2:
Image:
- 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
- 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
filter_svchost:
# Example of target object by svchost
# TargetObject: HKLM\SOFTWARE\Microsoft\MsixRegistryCompatibility\Package\Microsoft.Paint_11.2208.6.0_x64__8wekyb3d8bbwe\User\SOFTWARE\Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs\(Default)
# TargetObject: HKU\S-1-5-21-1000000000-000000000-000000000-0000_Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\TreatAs\(Default)
Image: 'C:\Windows\system32\svchost.exe'
filter_misexec:
# This FP has been seen during installation/updates
Image:
- 'C:\Windows\system32\msiexec.exe'
- 'C:\Windows\SysWOW64\msiexec.exe'
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate use
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
TargetObject|endswith: 'TreatAs\(Default)'
Stage 2: not filter_*
filter_office:
Image|startswith: 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
Image|endswith: '\OfficeClickToRun.exe'
filter_office2:
Image:
- 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
- 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
filter_svchost:
Image: 'C:\Windows\system32\svchost.exe'
filter_misexec:
Image:
- 'C:\Windows\system32\msiexec.exe'
- 'C:\Windows\SysWOW64\msiexec.exe'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Image | ends_with | \OfficeClickToRun.exe |
Image | starts_with | C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ |
Image | eq | C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe |
Image | eq | C:\Program Files\Microsoft Office\root\integration\integrator.exe |
Image | eq | C:\Windows\SysWOW64\msiexec.exe |
Image | eq | C:\Windows\system32\msiexec.exe |
Image | eq | C:\Windows\system32\svchost.exe |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TargetObject | ends_with |
|