Inter-Process Communication: Component Object Model

Bumblebee can use a COM object to execute queries to gather system information.^[4]

CLAIMLOADER has leveraged Component Object Model (COM) objects to create a scheduled task using ITaskService interface.^[5]

DarkTortilla has used the WshShortcut COM object to create a .lnk shortcut file in the Windows startup folder.^[6]

FunnyDream can use com objects identified with CLSID_ShellLink(IShellLink and IPersistFile) and WScript.Shell(RegWrite method) to enable persistence mechanisms.^[7]

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.^[8][9]

Gelsemium can use the IARPUinstallerStringLauncher COM interface are part of its UAC bypass process.^[10]

HermeticWizard can execute files on remote machines using DCOM.^[11]

InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.^[12]

Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.^[13][14]

Medusa Group has leveraged Component Object Model (COM) to bypass UAC.^[15]

Milan can use a COM component to generate scheduled tasks.^[16]

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.^[17][18][19]

Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.^[20]

POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.^[21]

Ramsay can use the Windows COM API to schedule tasks and maintain persistence.^[22]

Raspberry Robin creates an elevated COM object for CMLuaUtil and uses this to set a registry value that points to the malicious LNK file during execution.^[23]

SILENTTRINITY can insert malicious shellcode into Excel.exe using a Microsoft.Office.Interop object.^[24]

STATICPLUGIN has utilized Windows COM Installer Object to download an MSI package containing files masqueraded as a BMP file.^[25]

TrickBot used COM to setup scheduled task for persistence.^[26]

Ursnif droppers have used COM objects to execute the malware's full executable payload.^[27]

Ensure all COM alerts and Protected View are enabled.^[28]

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.^[29]

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.^{[30] [31]}