Potential Persistence Via Scrobj.dll COM Hijacking

 1title: Potential Persistence Via Scrobj.dll COM Hijacking
 2id: fe20dda1-6f37-4379-bbe0-a98d400cae90
 3status: test
 4description: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
 7author: frack113
 8date: 2022-08-20
 9modified: 2023-08-17
10tags:
11    - attack.privilege-escalation
12    - attack.persistence
13    - attack.t1546.015
14logsource:
15    category: registry_set
16    product: windows
17detection:
18    selection:
19        TargetObject|endswith: 'InprocServer32\(Default)'
20        Details: 'C:\WINDOWS\system32\scrobj.dll'
21    condition: selection
22falsepositives:
23    - Legitimate use of the dll.
24level: medium
25simulation:
26    - type: atomic-red-team
27      name: COM Hijacking - InprocServer32
28      technique: T1546.015
29      atomic_guid: 48117158-d7be-441b-bc6a-d9e36e47b52b