Inter-Process Communication: Component Object Model
- ID
- T1559.001
- Tactics
- TA0002 Execution
- Sub-technique of
- T1559 Inter-Process Communication
- Platforms
- Windows
- Data sources
- Process Creation, Module Load, Windows Registry Key Access
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.[5] Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).[6] Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).[5]
Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic.[6] Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.[5][7]
Detection
- DET0224 Detect Abuse of Component Object Model (T1559.001)
Data components: Process Creation, Module Load, Windows Registry Key Access
Mitigations (2)
- M1026 Privileged Account Management
Modify Registry settings (directly or using Dcomcnfg.exe) in
HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID}associated with the process-wide security of individual COM applications.[1]Modify Registry settings (directly or using Dcomcnfg.exe) in
HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Oleassociated with system-wide security defaults for all COM applications that do no set their own process-wide security.[2] [3]- M1048 Application Isolation and Sandboxing
Ensure all COM alerts and Protected View are enabled.[4]
Groups (4)
Software (18)
- S0223 POWERSTATS
- S0260 InvisiMole
- S0266 TrickBot
- S0386 Ursnif
- S0458 Ramsay
- S0666 Gelsemium
- S0691 Neoichor
- S0692 SILENTTRINITY
- S0698 HermeticWizard
- S1015 Milan
- S1039 Bumblebee
- S1044 FunnyDream
- S1066 DarkTortilla
- S1130 Raspberry Robin
- S1160 Latrodectus
- S1236 CLAIMLOADER
- S1238 STATICPLUGIN
- S9037 RustyWater
References
- Microsoft Process Wide Com Keys
- Microsoft System Wide Com Keys
- Microsoft COM ACL
- Microsoft Protected View
- Fireeye Hunting COM June 2019
- Microsoft COM
- ProjectZero File Write EoP Apr 2018