Removal of Potential COM Hijacking Registry Keys

calendar Jul 14, 2025 · attack.defense-evasion attack.t1112  ·
Share on: linkedin copy

Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.

Sigma rule (View on GitHub)

 1title: Removal of Potential COM Hijacking Registry Keys
 2id: 96f697b0-b499-4e5d-9908-a67bec11cdb6
 3status: test
 4description: |
 5    Detects any deletion of entries in ".*\shell\open\command" registry keys.
 6    These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.    
 7references:
 8    - https://github.com/OTRF/detection-hackathon-apt29/issues/7
 9    - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md
10    - https://learn.microsoft.com/en-us/windows/win32/shell/launch
11    - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
12    - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
13author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
14date: 2020-05-02
15modified: 2025-07-11
16tags:
17    - attack.defense-evasion
18    - attack.t1112
19logsource:
20    product: windows
21    category: registry_delete
22detection:
23    selection:
24        EventType: 'DeleteKey'
25        TargetObject|endswith: '\shell\open\command'
26    filter_svchost:
27        Image: 'C:\Windows\system32\svchost.exe'
28    filter_office:
29        Image|startswith:
30            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
31            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
32        Image|endswith: '\OfficeClickToRun.exe'
33    filter_integrator:
34        Image:
35            - 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
36            - 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
37    filter_dropbox:
38        Image|endswith: '\Dropbox.exe'
39        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
40        TargetObject|contains: '\Dropbox.'
41    filter_wireshark:
42        Image|endswith: '\AppData\Local\Temp\Wireshark_uninstaller.exe'
43        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
44        TargetObject|contains: '\wireshark-capture-file\'
45    filter_opera:
46        Image|startswith:
47            - 'C:\Program Files\Opera\'
48            - 'C:\Program Files (x86)\Opera\'
49        Image|endswith: '\installer.exe'
50    filter_peazip:
51        Image|contains: 'peazip'
52        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
53        TargetObject|contains: '\PeaZip.'
54    filter_everything:
55        Image|endswith: '\Everything.exe'
56        # We don't use the HKCR anchor as it could be logged as a different variation (HKEY_CLASSES_ROOT)
57        TargetObject|contains: '\Everything.'
58    filter_uninstallers:
59        # This image path is linked with different uninstallers when running as admin unfortunately
60        Image|startswith: 'C:\Windows\Installer\MSI'
61    filter_java:
62        Image|startswith: 'C:\Program Files (x86)\Java\'
63        Image|endswith: '\installer.exe'
64        TargetObject|contains: '\Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F}'
65    filter_edgeupdate:
66        Image|contains: '\Microsoft\EdgeUpdate\Install'
67    condition: selection and not 1 of filter_*
68falsepositives:
69    - Legitimate software (un)installations are known to cause some false positives. Please add them as a filter when encountered
70level: medium

References

Related rules

to-top