Verclsid.exe Runs COM Object

Title: Verclsid.exe Runs COM Object
Status: test
Description:Detects when verclsid.exe is used to run COM object via GUID
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Verclsid/
  -https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
  -https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
modified:2025-10-07
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\verclsid.exe' OriginalFileName:'verclsid.exe'   selection_cli:
    CommandLine|contains|all:
      -'/S'
      -'/C'

  filter_main_runtimebroker:
    ParentImage|endswith: 'C:\Windows\System32\RuntimeBroker.exe'
    CommandLine|contains|all:
      -'verclsid.exe" /S /C {'
      -'} /I {'

  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium