Techniques › T1559.001 › AN0628
AN0628 Analytic 0628
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects anomalous use of COM objects for execution, such as Office applications spawning scripting engines, enumeration of COM interfaces via registry queries, or processes loading atypical DLLs through COM activation. Correlates process creation, module loads, and registry queries to flag suspicious COM-based code execution or persistence.</p>
- Detects
- T1559.001 Component Object Model
- Part of
- DET0224 Detect Abuse of Component Object Model (T1559.001)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0050 Windows Registry Key Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
COMObjectAllowList | Legitimate COM CLSIDs and ProgIDs used by enterprise applications, to reduce false positives. |
ParentProcessExclusions | Expected parent-child process relationships (e.g., explorer.exe spawning dllhost.exe). |
TimeWindow | Threshold for correlating COM object execution with subsequent process creation or DLL load. |