Applied Cybernetics Group
T1559.001 Component Object Model
- Technique
T1559.001- Tactics
- Execution
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 4
- Elastic, Splunk
- 13
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1559/001
MITRE description
Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-15Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering
Detection coverage
SigmaHQ community rules
- Dllhost.EXE Initiated Network Connection To Non-Local IP Address (threat-hunting)
- DNS Query Request By Regsvr32.EXE (core)
- Network Connection Initiated By Regsvr32.EXE (core)
- CMSTP Execution Process Access (core)
Elastic and Splunk rules
- Suspicious Inter-Process Communication via Outlook (elastic)
- Potential Command and Control via Internet Explorer (elastic)
- Execution of COM object via Xwizard (elastic)
- Suspicious Explorer Child Process (elastic)
- Remote XSL Script Execution via COM (elastic)
- Incoming DCOM Lateral Movement via MSHTA (elastic)
- Incoming DCOM Lateral Movement with MMC (elastic)
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows (elastic)
- Suspicious Image Load (taskschd.dll) from MS Office (elastic)
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface (elastic)
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer (elastic)
- UAC Bypass via ICMLuaUtil Elevated COM Interface (elastic)
- Process Writing DynamicWrapperX (splunk)