load malicious registered COM objects

Detects COM object hijacking via TreatAs subkey

Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a supsicious or unsuale location

Detects potential persistence using Appx DebugPath

Detects potential COM object hijacking leveraging the COM Search Order

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Detect modification of TreatAs key to enable "rundll32.exe -sta" command

Detects suspicious Powershell code that execute COM Objects