MITRE ATT&CK LAB

MITRE ATT&CK

Various tests involving methods outlined within the MITRE ATT&CK framework

MITRE ATT&CK™ Analysis - T1546.015 Component Object Model Hijacking

less than 1 minute read

Component Object Model Hijacking Overview

An adversary is able to hijack COM references and relationships as a means for persistence by modifying specific registry keys.

Component Object Model Hijacking Analysis

Lab Example

RED TEAM: ATTACK

Rundll32.exe executing an arbitrary executable through a malicious dll replacement.

T1122 - Component Object Hijacking 1

The end result is whenever a thumbnail is viewed, the calculator is executed on this host.

BLUE TEAM: DEFEND

The DLLHost parent executable gives away the impacted CLSID (Com Object) registry key and we can use this to remediate the system.

T1122 - Component Object Hijacking 2

You may also enjoy

ClearFake - Malware Analysis Lab

26 minute read

Analysis of ClearFake malware which is planted on compromised WordPress websites to convince unsuspecting visitors to download and run malware.

LummaC2 - Malware Analysis Lab

30 minute read

Analysis of a RAR file which leads to the discovery of malicious Github repositories designed to distribute malware.