Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1546.015sub-technique of T1546 Event Triggered Execution

Component Object Model Hijacking

Windowsnothing on this site yetT1546.015 on attack.mitre.org

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

2

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Windows COM Hijacking Detection via Registry and DLL Load Correlation

  • Correlate suspicious registry modifications to known COM object CLSIDs with subsequent DLL loads or unexpected binary execution paths. Detect placement of COM CLSID entries under HKEY_CURRENT_USER\Software\Classes\CLSID\ overriding default HKLM paths.

the rest of T1546

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.