COM is the Windows plumbing that lets one piece of software call methods on another. That convenience is why attackers like it. Component Object Model (T1559.001) is an Execution technique for Windows and a subtechnique of Inter-Process Communication.
How attackers use it
MITRE describes COM as an IPC component of the native Windows API that lets a client object call methods on server objects, which are typically DLLs or EXEs. Remote COM execution runs through Remote Services such as Distributed COM.
Various COM interfaces can be abused to invoke arbitrary execution through languages such as C, C++, Java and Visual Basic. Specific COM objects can also perform actions beyond code execution, such as creating a scheduled task, fileless download and execution, and other behaviors tied to privilege escalation and persistence.
How to detect it
MITRE's analytic correlates process creation, module loads and registry queries to flag Office applications spawning scripting engines, enumeration of COM interfaces through registry queries, and processes loading atypical DLLs through COM activation.
The data you need is process creation with parent details, module load events and registry query events. Sysmon provides all three on Windows, as event IDs 1, 7 and 13 for process creation, image load and registry value sets.
How to reduce the risk
MITRE lists two mitigations.
- Privileged account management. Modify registry settings, directly or with Dcomcnfg.exe, under the AppID keys for process-wide COM application security, and under the Ole key for system-wide security defaults.
- Application isolation and sandboxing. Make sure all COM alerts and Protected View are enabled.
Why defenders care
COM is not a flaw. It is the way a large share of Windows software works, which is why you cannot simply switch it off. The practical stance is to narrow it. Keep the security settings tight, keep Protected View and COM alerts on so documents from outside cannot call objects freely, and watch the processes that use COM to start other programs. The same Office-to-interpreter process pattern that flags DDE abuse flags COM abuse too, so one good rule covers both.
Quick check
Which tool does MITRE name for adjusting COM security settings?
Dcomcnfg.exe, or direct registry edits under the AppID and Ole keys.
