Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 122,
    "key": "com-hijacking",
    "unprotect_id": "U1212",
    "name": "COM Hijacking",
    "description": "COM hijacking is a technique used by adversaries to insert malicious code into the Windows operating system through the Microsoft Component Object Model (COM). \r\n\r\nCOM is a system that allows software components to interact with each other, and adversaries can abuse this system to execute their own code in place of legitimate software. To achieve this, they alter references and relationships in the COM system by modifying the Windows Registry. Specifically, they replace a reference to a legitimate system component with a reference to their own malicious code. \r\n\r\nWhen the legitimate component is executed through normal system operation, the adversary's code is executed instead. This can provide a means for the adversary to achieve persistence, as they can choose to hijack objects that are used frequently enough to maintain a consistent level of persistence. However, they must be careful not to break noticeable functionality within the system, as this could cause system instability and potentially lead to detection.",
    "resources": "https://www.endgame.com/blog/technical-blog/how-hunt-detecting-persistence-evasion-com",
    "creation_date": "2019-03-23T17:34:46Z",
    "tags": "Microsoft Component Object Model (COM),\r\nsoftware components,\r\ninteraction,\r\nWindows operating system,\r\npersistence,",
    "modification_date": "2023-10-04T10:43:57.166000Z",
    "category": [
        4
    ],
    "rules": [],
    "attachments": [],
    "featured_api": [
        331,
        469
    ],
    "contributors": []
}