Potential Persistence Via Scrobj.dll COM Hijacking

calendar Aug 12, 2024 · attack.persistence attack.t1546.015  ·
Share on: linkedin copy

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Sigma rule (View on GitHub)

 1title: Potential Persistence Via Scrobj.dll COM Hijacking
 2id: fe20dda1-6f37-4379-bbe0-a98d400cae90
 3status: test
 4description: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
 7author: frack113
 8date: 2022-08-20
 9modified: 2023-08-17
10tags:
11    - attack.persistence
12    - attack.t1546.015
13logsource:
14    category: registry_set
15    product: windows
16detection:
17    selection:
18        TargetObject|endswith: 'InprocServer32\(Default)'
19        Details: 'C:\WINDOWS\system32\scrobj.dll'
20    condition: selection
21falsepositives:
22    - Legitimate use of the dll.
23level: medium

References

Related rules

to-top