COM Hijacking via TreatAs
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND (OBJECTNAME endswith "TreatAs\(Default)" OR (OBJECTNAME endswith "TreatAs" AND OBJECTVALUENAME = "(Default)")) AND ((PROCESSNAME notstartswith "C:\Program Files\Common Files\Microsoft Shared\ClickToRun" OR PROCESSNAME notendswith "\OfficeClickToRun.exe") AND PROCESSNAME != "C:\Program Files\Microsoft Office\root\integration\integrator.exe,C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe" AND PROCESSNAME != "C:\Windows\system32\svchost.exe" AND PROCESSNAME != "C:\Windows\system32\msiexec.exe,C:\Windows\SysWOW64\msiexec.exe") select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
