Sunturai
Back to results
MediumSigmaHQRoberto Rodriguez (Cyb3rWard0g) +1

Removal of Potential COM Hijacking Registry Keys

Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps…

Description

Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
windows
Log source category
registry_delete

Known benign triggers

  • Legitimate software (un)installations are known to cause false positives. Please add them as a filter when encountered

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice