Skip to content
λmaldev wiki/
pagesCOM Hijacking via TreatAs
T1546.015WindowsRegistryC / C++

COM Hijacking via TreatAs

updated 2026-07-115 min readthehackersbrain
Authorized use only. This material is published for detection engineering, malware analysis and authorized red-team engagements. Running these techniques against systems you do not own or have written permission to test is illegal.

Overview

COM resolves a class identifier to an implementation by walking the registry, and it checks the per-user hive before the machine hive. A TreatAs value under a CLSID tells COM “when anyone asks for this class, give them that one instead” — a redirection primitive that needs no administrative rights and no file in a protected directory.

The result is persistence that executes inside whichever signed process next instantiates the hijacked class, with no autorun entry and no scheduled task to enumerate.

Note.

Abandoned CLSIDs — classes referenced by a task or shell extension but no longer registered — are the quieter target. Nothing breaks when you claim one, because nothing was answering before.

The call chain

  1. 1
    pick a frequently instantiated CLSID
    Anything the shell, a scheduled task or Explorer resolves on a predictable trigger.
  2. 2
    write HKCU\Software\Classes\CLSID\{...}\TreatAs
    Per-user hive wins over HKLM and needs no administrative rights.
  3. 3
    register the substitute InprocServer32
    Point the replacement CLSID at a DLL under a user-writable path.
  4. 4
    (wait for the trigger)
    The next CoCreateInstance for the original CLSID loads the substitute inside a signed host.

Reference implementation

treatas.regregistry
Windows Registry Editor Version 5.00

; redirect a system CLSID to one we control — HKCU beats HKLM
[HKEY_CURRENT_USER\Software\Classes\CLSID\{0358B920-0AC7-461F-98F4-58E32CD89148}\TreatAs]
@="{D20A0000-0000-0000-C000-000000000046}"

[HKEY_CURRENT_USER\Software\Classes\CLSID\{D20A0000-0000-0000-C000-000000000046}\InprocServer32]
@="C:\\Users\\analyst\\AppData\\Local\\Temp\\payload.dll"
"ThreadingModel"="Apartment"

Detection

SYSMON EID 13
Registry write adding a TreatAs subkey under a CLSID owned by a shipped Windows component.
SYSMON EID 7
A DLL from a user-writable path loaded by a signed system binary shortly after that write.
INVENTORY
Any HKCU CLSID entry that shadows an HKLM one — enumerate and diff, the legitimate set is small.
BEHAVIOURAL
InprocServer32 values pointing outside System32, WinSxS or Program Files.

This is an inventory problem rather than a memory problem. Snapshot the user hive’s Classes\CLSID subtree on a schedule and alert on additions that shadow a machine-hive class — the legitimate rate of change on a managed endpoint is close to zero.

Variants & related

T1547.001Registry Run KeysLouder, simpler, and still the most commonly observed persistence.
T1546.003WMI Event SubscriptionsSame "wait for a trigger" model, in a different subsystem.
Was this page useful?edit this page ↗