CmdID

CmdID / Techniques / T1546

T1546.015 Event Triggered Execution: Component Object Model Hijacking

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. MITRE ATT&CK

1 program on CmdID 2 Sigma rules T1546.015 on attack.mitre.org

Part of

MITRE ATT&CK
T1546Event Triggered Execution

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

Sigma rules tagged with it

process creation, the highest levels first
highRundll32 Registered COM Objectsfrack113 · Windows
highSOURGUM Actor BehavioursMSTIC, FPT.EagleEye · Windows