Threat Hunting Exercise: Analyzing Windows COM Hijacking Persistence Dataset
This hunt uses a simulated endpoint dataset (windows_com_hijack_2022-08-12T100000.json) capturing T1546.015: Component Object Model Hijacking, where an attacker overwrites a COM object's registered InprocServer32/LocalServer32 path in the registry so that a commonly-invoked Windows component (e.g., Explorer's shell extension handler) loads an attacker-controlled DLL instead of the legitimate one.
Step 1: Hypothesis Formation
Hypothesis: A registry value under HKCU\Software\Classes\CLSID\{...}\InprocServer32 (or the HKLM equivalent) is modified to point to a DLL in a non-standard, user-writable location, and that CLSID corresponds to a component routinely loaded by explorer.exe or another high-frequency process - providing durable, low-visibility persistence that re-triggers on every relevant COM instantiation. Indicators:
- A CLSID registry key modification where the new DLL path is outside
System32/Program Files. - The referenced CLSID is one commonly auto-loaded by Explorer (e.g., shell icon handlers, context-menu handlers) rather than an obscure, rarely-invoked class.
- The DLL was written to disk moments before the registry modification.
explorer.exe(or another parent unrelated to the dropped file) loads the hijacked DLL on subsequent logons/launches.
Null Hypothesis: A legitimate third-party shell-extension installer (e.g., an archiving tool, cloud-storage client) is registering its own COM handler as part of normal installation. Invalidate by checking Add/Remove Programs and the digital signature of the referenced DLL.
Rationale: COM hijacking persists across reboots without a scheduled task, service, or Run key - making it invisible to the persistence locations most defenders check first; this hunt validates CLSID-registry-write monitoring as a detection layer for a technique specifically chosen for its low forensic footprint.
Step 2: Data Sources and Scope
- Sources: Sysmon Event ID 13 (Registry Value Set) filtered on CLSID paths; Sysmon Event ID 7 (Image Load) for explorer.exe; Sysmon Event ID 11 (File Create) for the dropped DLL.
- Scope: ~2022-08-12T10:00:00-10:02:00 UTC, with re-trigger observed at next logon ~2022-08-12T17:45:00 UTC; Host: WKS-LEGAL-008 (10.200.4.12); User: r.patel.
- SIEM Queries (Splunk/ELK):
index=sysmon EventCode=13 TargetObject="CLSIDInprocServer32*" | table _time Computer TargetObject Detailsindex=sysmon EventCode=7 Image="explorer.exe" | search ImageLoaded=<hijacked_dll_path>- Correlate drop-then-register:
... | transaction Computer maxspan=5m startswith(EventCode=11) endswith(EventCode=13)
Step 3: Key Findings
Parsed events (5 shown) confirm a DLL was dropped and registered against the CLSID for the Shell Icon Overlay handler, then silently reloaded by explorer.exe at the next user logon.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-12 10:00:03 | WKS-LEGAL-008 | Sysmon 11 - File Create | %APPDATA%\Microsoft\Windows\shellcache.dll written | Staging IOC: dropped in a plausible-looking but non-standard AppData path just before the registry change. |
| 2022-08-12 10:00:08 | WKS-LEGAL-008 | Sysmon 13 - Registry Set | HKCU\Software\Classes\CLSID\{087C8C6E-A6B6-4172-A66A-11774022B575}\InprocServer32\(Default) = %APPDATA%\Microsoft\Windows\shellcache.dll | Hijack IOC: this CLSID corresponds to a built-in Shell Icon Overlay identifier handler, normally pointed at a signed System32 DLL - now redirected to the dropped file. |
| 2022-08-12 10:00:09 | WKS-LEGAL-008 | (signature check) | shellcache.dll is unsigned, 44KB, compiled minutes prior | Confirms this is attacker tooling, not a legitimate shell extension. |
| 2022-08-12 17:45:12 | WKS-LEGAL-008 | Sysmon 7 - Image Load | explorer.exe loads shellcache.dll at user logon, no user interaction required | Persistence-Trigger IOC: this demonstrates the hijack re-activates automatically on every Explorer session, with no Run key, service, or scheduled task involved. |
| 2022-08-12 17:45:15 | WKS-LEGAL-008 | Network | explorer.exe (via injected code) beacons to 45.63.88.201:8443 | Confirms the hijacked DLL executes C2 beacon logic under cover of the trusted explorer.exe process. |
Validation:
- Timeline: DLL drop and CLSID registration within 5 seconds, then silent reactivation at the next logon with no other persistence artifact present - a textbook COM hijack, deliberately avoiding Run keys/scheduled tasks that defenders check first.
- False Positives: no shell-extension installer or Add/Remove Programs entry accounts for this DLL; it is unsigned and freshly compiled.
- Correlation: drop-then-register sequence, non-standard file location, and subsequent explorer.exe beaconing together confirm malicious COM hijacking.
Step 4: Recommendations & Next Steps
- Immediate Response: Remove the malicious
InprocServer32registry value and restore/remove the CLSID key; deleteshellcache.dll; isolate WKS-LEGAL-008; block 45.63.88.201; check other CLSIDs on the host and fleet-wide for similar redirections. - Detection: Sigma-style rule:
title: COM Hijacking - CLSID InprocServer32 Points to Non-Standard Path→selection: EventID=13 AND TargetObject="InprocServer32" AND Details NOT IN ("\\System32\\", "\\Program Files\\"). - Pro Tip: Baseline all CLSID InprocServer32/LocalServer32 values fleet-wide and alert on any deviation - because COM hijacking survives reboots without touching the persistence locations most autoruns tools default to checking, a registry-baseline diff is the most reliable way to catch it.
Hypothesis confirmed - an attacker hijacked a Shell Icon Overlay COM handler to achieve reboot-persistent, Explorer-triggered C2 beaconing without using any Run key, service, or scheduled task!