{'created': '2017-05-31T21:31:33.979Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'The Component Object Model (COM) is a system within Windows '
                'to enable interaction between software components through the '
                'operating system. (Citation: Microsoft Component Object '
                'Model) Adversaries can use this system to insert malicious '
                'code that can be executed in place of legitimate software '
                'through hijacking the COM references and relationships as a '
                'means for persistence. Hijacking a COM object requires a '
                'change in the Windows Registry to replace a reference to a '
                'legitimate system component which may cause that component to '
                'not work when executed. When that system component is '
                "executed through normal system operation the adversary's code "
                'will be executed instead. (Citation: GDATA COM Hijacking) An '
                'adversary is likely to hijack objects that are used '
                'frequently enough to maintain a consistent level of '
                'persistence, but are unlikely to break noticeable '
                'functionality within the system as to avoid system '
                'instability that could lead to detection.',
 'external_references': [{'external_id': 'T1122',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1122'},
                         {'description': 'Microsoft. (n.d.). The Component '
                                         'Object Model. Retrieved August 18, '
                                         '2016.',
                          'source_name': 'Microsoft Component Object Model',
                          'url': 'https://msdn.microsoft.com/library/ms694363.aspx'},
                         {'description': 'G DATA. (2014, October). COM Object '
                                         'hijacking: the discreet way of '
                                         'persistence. Retrieved August 13, '
                                         '2016.',
                          'source_name': 'GDATA COM Hijacking',
                          'url': 'https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence'},
                         {'description': 'Ewing, P. Strom, B. (2016, September '
                                         '15). How to Hunt: Detecting '
                                         'Persistence & Evasion with the COM. '
                                         'Retrieved September 15, 2016.',
                          'source_name': 'Elastic COM Hijacking',
                          'url': 'https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com'}],
 'id': 'attack-pattern--9b52fca7-1a36-4da0-b62d-da5bd83b4d69',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-10-24T17:49:08.403Z',
 'name': 'Component Object Model Hijacking',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': True,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['ENDGAME'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.1'}