Per-user CLSID registered with a payload under InprocServer32 or LocalServer32

Siemphony@siemphonymediumT1546.015unverifiedPlaybook · Persistence established

AN1323's registry source is Security EventID 4657, but this rule is written in Sysmon's registry_set vocabulary (a single TargetObject) because that is what the brief's sigmaLogsource declares; a deployment feeding from 4657 instead needs its ObjectName/ObjectValueName fields mapped onto TargetObject first — enabling Audit Registry and a SACL alone does not make 4657 fit this shape. The match targets the actual hijack mechanism — a CLSID under `HKEY_CURRENT_USER\Software\Classes\CLSID\` (Sysmon's `HKU\` prefix) overriding the machine-wide HKLM registration — and ends on the CLSID's InprocServer32/LocalServer32 subkey and its `(Default)` value, because that is where the payload path actually lives; the CLSID key's own value carries nothing. The module load or execution MITRE correlates against this write is a cross-event join Sigma cannot express, and most public Sysmon configs filter `\Software\Classes` out as noise, so this needs an explicit include rule first. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0481, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Per-user CLSID registered with a payload under InprocServer32 or LocalServer322id: c9951408-0230-4b5c-8e36-0bcd444ed9953status: experimental4description: |5  AN1323's registry source is Security EventID 4657, but this rule is written6  in Sysmon's registry_set vocabulary (a single TargetObject) because that is7  what the brief's sigmaLogsource declares; a deployment feeding from 46578  instead needs its ObjectName/ObjectValueName fields mapped onto TargetObject9  first — enabling Audit Registry and a SACL alone does not make 4657 fit this10  shape. The match targets the actual hijack mechanism — a CLSID under11  `HKEY_CURRENT_USER\Software\Classes\CLSID\` (Sysmon's `HKU\` prefix)12  overriding the machine-wide HKLM registration — and ends on the CLSID's13  InprocServer32/LocalServer32 subkey and its `(Default)` value, because that14  is where the payload path actually lives; the CLSID key's own value carries15  nothing. The module load or execution MITRE correlates against this write is16  a cross-event join Sigma cannot express, and most public Sysmon configs17  filter `\Software\Classes` out as noise, so this needs an explicit include18  rule first.19  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0481, not hand-written and not tested by its author. Any lab result is on this rule's own page.20references:21  - https://attack.mitre.org/techniques/T1546/01522  - https://attack.mitre.org/detectionstrategies/DET048123author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)24date: 2026-08-1625tags:26  - attack.privilege-escalation27  - attack.persistence28  - attack.t1546.01529logsource:30  category: registry_set31  product: windows32detection:33  selection_hive:34    TargetObject|startswith: 'HKU\'35  selection_com_path:36    TargetObject|contains: '\Software\Classes\CLSID\'37  selection_payload_value:38    TargetObject|endswith:39      - '\InprocServer32\(Default)'40      - '\LocalServer32\(Default)'41  condition: selection_hive and selection_com_path and selection_payload_value42falsepositives:43  - "Application installers and updaters that register per-user COM components without needing admin rights — browser toolbars and extensions, Office and Adobe shell-integration add-ins, and cloud-storage overlay-icon handlers all write InprocServer32 under HKCU as their normal install step, and this is the highest-volume source on a general-purpose fleet."44  - "Non-persistent VDI, App-V and roaming-profile environments that reprovision per-user COM registrations from a template on every logon, producing a recurring hit for the same CLSID across every session on every host."45  - "Shell-extension and productivity tools that deliberately use a per-user CLSID to avoid requiring elevation — 7-Zip, WinRAR and similar archivers, and cloud-sync clients placing a Explorer overlay handler, are legitimate uses of the exact registration shape this rule is written to catch."46  - "Endpoint security and browser-monitoring agents that register their own per-user COM hooks for legitimate inspection, which are structurally identical to a hijack from this rule's point of view."47level: medium

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where ((RegistryKey startswith "HKU\\" and RegistryKey contains "\\Software\\Classes\\CLSID\\") and (RegistryKey endswith "\\InprocServer32\\(Default)" or RegistryKey endswith "\\LocalServer32\\(Default)"))

Splunk · SPL

Run this as a search.

index=* ((TargetObject="HKU\\*" AND TargetObject="*\\Software\\Classes\\CLSID\\*") AND (TargetObject="*\\InprocServer32\\(Default)" OR TargetObject="*\\LocalServer32\\(Default)"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(registry.path) LIKE "hku\\\\*" AND TO_LOWER(registry.path) LIKE "*\\\\software\\\\classes\\\\clsid\\\\*") AND (TO_LOWER(registry.path) LIKE "*\\\\inprocserver32\\\\(default)" OR TO_LOWER(registry.path) LIKE "*\\\\localserver32\\\\(default)"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)^HKU\\</field>    <field name="TargetObject" type="pcre2">(?i)\\Software\\Classes\\CLSID\\</field>    <field name="TargetObject" type="pcre2">(?i)(\\InprocServer32\\\(Default\)$|\\LocalServer32\\\(Default\)$)</field>    <description>Per-user CLSID registered with a payload under InprocServer32 or LocalServer32</description>    <mitre>      <id>T1546.015</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c9951408-0230-4b5c-8e36-0bcd444ed995

ATT&CKT1546.015

T1546.015Component Object Model Hijacking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.015, evaluated against their registry_set events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's mutableElements name four knobs for AN1323: RegistryPathScope, BinaryPathAnomalyThreshold, TimeWindow, and UserContextFilter. Only two are usable on this single-event rule. RegistryPathScope maps to narrowing selection_com_path to specific known-sensitive CLSIDs instead of the whole tree. UserContextFilter maps to restricting by user SID — flagging service or admin accounts registering per-user CLSIDs is far more suspicious than an ordinary user doing it. BinaryPathAnomalyThreshold and TimeWindow both assume the load-correlation this rule cannot express, so they're not actionable here without a separate join.

Declared by the author

Application installers and updaters that register per-user COM components without needing admin rights — browser toolbars and extensions, Office and Adobe shell-integration add-ins, and cloud-storage overlay-icon handlers all write InprocServer32 under HKCU as their normal install step, and this is the highest-volume source on a general-purpose fleet.
Non-persistent VDI, App-V and roaming-profile environments that reprovision per-user COM registrations from a template on every logon, producing a recurring hit for the same CLSID across every session on every host.
Shell-extension and productivity tools that deliberately use a per-user CLSID to avoid requiring elevation — 7-Zip, WinRAR and similar archivers, and cloud-sync clients placing a Explorer overlay handler, are legitimate uses of the exact registration shape this rule is written to catch.
Endpoint security and browser-monitoring agents that register their own per-user COM hooks for legitimate inspection, which are structurally identical to a hijack from this rule's point of view.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

This rule catches one specific COM-hijack mechanic: a per-user CLSID override that carries a payload path. It fires only when all three selections match together — selection_hive requires TargetObject|startswith: 'HKU\', selection_com_path requires TargetObject|contains: '\Software\Classes\CLSID\', and selection_payload_value requires the object to end in \InprocServer32\(Default) or \LocalServer32\(Default). That combination is the actual hijack shape: HKCU's Classes\CLSID tree shadows the machine-wide HKLM registration for the same CLSID, and Windows resolves the per-user copy first — no admin rights needed. The rule deliberately does not stop at the CLSID key itself; it walks down to the InprocServer32/LocalServer32 subkey's unnamed (Default) value, because that's where the DLL or EXE path actually lives. The CLSID key alone carries no payload.

02 · Telemetry you need

The logsource is category: registry_set, product: windows, copied verbatim from the brief — this is Sysmon's registry vocabulary, a single TargetObject string. The brief's own source for this analytic is Security EventID 4657, but 4657 splits the same information into ObjectName and ObjectValueName instead of one field. The rule's description calls this out explicitly, per the corpus convention: if you're feeding 4657 instead of Sysmon, you cannot just enable Audit Registry and a SACL and expect a match — the fields have to be re-mapped onto TargetObject first. Separately, most public Sysmon configs filter \Software\Classes out by default as noise, so this rule needs an explicit include rule added before it will ever see an event.

03 · How the logic works

AN1323 as written asks for a correlation: suspicious CLSID registry writes joined to a subsequent DLL load or unexpected execution path. This rule only covers the registry-write half. There is no time-window or cross-event join here — lib/sigma in this corpus has no aggregation or near support, so a rule like this is precursor-only by construction. It flags the setup (the hijacked pointer), not the trigger (something actually loading through it). That gap is normal for this corpus, not a defect in this rule specifically — treat any hit as "someone planted a redirect," and go hunting for the load event yourself.

04 · Common false positives

This is the rule's real weak point, and the review caught it precisely: level: medium, but the first falsepositives entry says legitimate per-user COM registration by installers, updaters, browser toolbars, and shell-integration add-ins is "the highest-volume source on a general-purpose fleet." That's the same "dominant by a wide margin" framing that pushed sibling rules in this batch down to low — this rule uses equivalent language for its loudest false positive but wasn't calibrated the same way. Treat medium here with skepticism until you've narrowed the selector or seen it run. The review also flagged a false positive the rule's own author missed entirely: Windows Installer's advertised-shortcut self-repair mechanism rewrites per-user CLSID InprocServer32 entries on ordinary launch of older MSI-packaged software — a well-known noisy source in practice that isn't in the four listed entries.

05 · Detection maturity

tier_1: UNVERIFIED — this rule has never been executed against real data. There are no hit counts, no false-positive rates, and no tuned thresholds to report because none exist yet; treat every claim above as reasoning from the logic, not evidence from a deployment.

Related detections1 nearby

Registry queried for credential-related value names

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/c9951408-0230-4b5c-8e36-0bcd444ed995

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Per-user CLSID registered with a payload under InprocServer32 or LocalServer32

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it