T1559.001SubTechniqueexecutionagent-callable

T1559.001Component Object Model

Sub-technique of T1559

Platforms: Windows

ATT&CK version: 14.1

What it is

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)

ATT&CK tactics· 1

Execution

References

  1. https://attack.mitre.org/techniques/T1559/001
  2. https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html
  3. https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx
  4. https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
  5. https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/
  6. https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
Sourced from MITRE ATT&CK Enterprise v14.1. Curated and contextualized for EU compliance use cases by Adam Lundqvist, Founder at SQUR.
T1559.001: Component Object Model | SQUR Knowledge Base