Component Object Model (COM) hijacking (MITRE ATT&CK T1546.015) is a Windows persistence technique. COM is the system that lets software components interact through the operating system, and references to COM objects are stored in the registry.
How attackers use it
MITRE describes replacing a reference to a legitimate component with one that points to adversary code. When normal system activity runs that component, the adversary's code runs in its place.
The registry change can stop the original component from working, so an adversary is likely to pick objects used often enough to give steady persistence but unlikely to cause visible failures. That is a clue for defenders: hijacks aim to stay quiet.
MITRE also describes a variation that abuses Type Libraries (TypeLibs), which hold metadata about COM objects such as their interfaces and methods. By editing TypeLib registry keys, an adversary can redirect functionality to scripts or payloads. Where classic hijacking commonly uses local DLLs, this variation may use the script: moniker to run remote scripts hosted on external servers. The remote payload is downloaded each time the hijacked object is accessed.
How to detect it
MITRE's strategy correlates registry changes with later loads:
- Suspicious modifications to the registry entries of known COM object CLSIDs.
- CLSID entries under
HKEY_CURRENT_USER\Software\Classes\CLSID\that override default HKLM paths. - DLL loads or binary execution that trace back to those changes.
The HKCU override is a good rule to build. Per-user CLSID entries are uncommon on managed machines, and any that shadow a system object deserve scrutiny.
How to reduce the risk
MITRE lists no mitigations for this technique. Controls that help in practice are limiting registry write access, application control that blocks unexpected DLLs, and egress filtering that stops script monikers from fetching remote content.
Check your own environment
A read-only check from a Windows command prompt:
reg query HKCU\Software\Classes\CLSID
Many machines show few or no entries. Each entry that appears should map to a known application. For a deeper view, collect Sysmon event IDs 12 to 14 for HKCU\Software\Classes and event ID 7 for image loads.
Quick check
Why check HKCU when looking for COM hijacks?
Per-user CLSID registrations under HKCU\Software\Classes\CLSID can override the system registration in HKLM, and they can be written without administrator rights.
