Component Object Model
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
AN0628 is the only analytic and each of its three described behaviours is either already published under another technique or has no feed that can carry it. (1) 'Office applications spawning scripting engines' on Sysmon EventID 1 is the identical ParentImage/Image pair this corpus has already published three times: T1021.003 selects the Office set plus mmc.exe, dllhost.exe and wmiprvse.exe as parents against cmd/powershell/wscript/cscript/mshta/rundll32/regsvr32/msiexec/bitsadmin/certutil as children, and T1203 and T1204 cover the same shape with wider parent lists. A T1559.001 rule on that leg would re-detect the same process_creation events under a different technique id rather than add an observable. […]
What the technique is
Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM). Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic. Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0628
Detects anomalous use of COM objects for execution, such as Office applications spawning scripting engines, enumeration of COM interfaces via registry queries, or processes loading atypical DLLs through COM activation. Correlates process creation, module loads, and registry queries to flag suspicious COM-based code execution or persistence.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.