AN0628
Analytic 0628
Windows
Detects anomalous use of COM objects for execution, such as Office applications spawning scripting engines, enumeration of COM interfaces via registry queries, or processes loading atypical DLLs through COM activation. Correlates process creation, module loads, and registry queries to flag suspicious COM-based code execution or persistence.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=7
WinEventLog:Security
EventCode=4663, 4670, 4656
[COMObjectAllowList]
Legitimate COM CLSIDs and ProgIDs used by enterprise applications, to reduce false positives.
[ParentProcessExclusions]
Expected parent-child process relationships (e.g., explorer.exe spawning dllhost.exe).
[TimeWindow]
Threshold for correlating COM object execution with subsequent process creation or DLL load.