{'created': '2020-03-16T14:12:47.923Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may establish persistence by executing malicious '
                'content triggered by hijacked references to Component Object '
                'Model (COM) objects. COM is a system within Windows to enable '
                'interaction between software components through the operating '
                'system.(Citation: Microsoft Component Object Model)  '
                'References to various COM objects are stored in the '
                'Registry. \n'
                '\n'
                'Adversaries may use the COM system to insert malicious code '
                'that can be executed in place of legitimate software through '
                'hijacking the COM references and relationships as a means for '
                'persistence. Hijacking a COM object requires a change in the '
                'Registry to replace a reference to a legitimate system '
                'component which may cause that component to not work when '
                'executed. When that system component is executed through '
                "normal system operation the adversary's code will be executed "
                'instead.(Citation: GDATA COM Hijacking) An adversary is '
                'likely to hijack objects that are used frequently enough to '
                'maintain a consistent level of persistence, but are unlikely '
                'to break noticeable functionality within the system as to '
                'avoid system instability that could lead to detection. \n'
                '\n'
                'One variation of COM hijacking involves abusing Type '
                'Libraries (TypeLibs), which provide metadata about COM '
                'objects, such as their interfaces and methods. Adversaries '
                'may modify Registry keys associated with TypeLibs to redirect '
                'legitimate COM object functionality to malicious scripts or '
                'payloads. Unlike traditional COM hijacking, which commonly '
                'uses local DLLs, this variation may leverage the "script:" '
                'moniker to execute remote scripts hosted on external '
                'servers.(Citation: RELIAQUEST) This approach enables stealthy '
                'execution of code while maintaining persistence, as the '
                'remote payload would be automatically downloaded whenever the '
                'hijacked COM object is accessed.',
 'external_references': [{'external_id': 'T1546.015',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1546/015'},
                         {'description': 'Ewing, P. Strom, B. (2016, September '
                                         '15). How to Hunt: Detecting '
                                         'Persistence & Evasion with the COM. '
                                         'Retrieved September 15, 2016.',
                          'source_name': 'Elastic COM Hijacking',
                          'url': 'https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com'},
                         {'description': 'G DATA. (2014, October). COM Object '
                                         'hijacking: the discreet way of '
                                         'persistence. Retrieved August 13, '
                                         '2016.',
                          'source_name': 'GDATA COM Hijacking',
                          'url': 'https://blog.gdatasoftware.com/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence'},
                         {'description': 'Microsoft. (n.d.). The Component '
                                         'Object Model. Retrieved August 18, '
                                         '2016.',
                          'source_name': 'Microsoft Component Object Model',
                          'url': 'https://msdn.microsoft.com/library/ms694363.aspx'},
                         {'description': 'RELIAQUEST THREAT RESEARCH TEAM. '
                                         '(2025, April 11). Threat Spotlight: '
                                         'Hijacked and Hidden: New Backdoor '
                                         'and Persistence Technique. Retrieved '
                                         'June 27, 2025.',
                          'source_name': 'RELIAQUEST',
                          'url': 'https://reliaquest.com/blog/threat-spotlight-hijacked-and-hidden-new-backdoor-and-persistence-technique/'}],
 'id': 'attack-pattern--bc0f5e80-91c0-4e04-9fbb-e4e332c85dae',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'privilege-escalation'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-10-24T17:49:18.160Z',
 'name': 'Component Object Model Hijacking',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.3.0',
 'x_mitre_contributors': ['Elastic', 'ReliaQuest'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.3'}