↳ GitHub sourceAnalytics ruleMedium
Component Object Model Hijacking - Vault7 trick
Description
This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method.
The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.
- Rule type
- Scheduled
- Version
- 1.0.0
- Declared status
- Available
- Query frequency
- 1h
- Query period
- 1h
- Trigger
- gt 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
DeviceRegistryEvents
| where RegistryKey has "ShellFolder" and ActionType =~ "RegistryValueSet" and RegistryValueName =~ "Attributes"
// toint automatically converts base10 and base16 strings to int toint("0xFF") == toint("255") == int(0xFF) == int(255).
// We are using >= to make sure that if someone adds an additional flag to this field, it doesn't bypass this hunt.
// Removing any flag will bypass this hunt, but more research is needed to understand which of the flag values are relevant.
| where toint(RegistryValueData) >= int(0xf090013d)
//UPDATE: Flag details are here: https://medium.com/falconforce/introducing-falcon-friday-1f972d65ce1b?source=friends_link&sk=e48d9cb974e216cc4b9b61945a3b177d
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
1aaff41f-4e18-45b1-bb34-de6eb4943cf2
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC