Threat Actor Unknown origin

Attor

IoCs CSV 1 detection rule

Adversary group targeting diplomatic missions and governmental organisations.

MITRE ATT&CK TTPs 1

T1021.003

Distributed Component Object Model

Lateral Movement

Detection Rules

Attor_SIGMA_Detection

sigma ai_generated

title: Suspicious COM Object Instantiation for Remote Access via DCOM
id: 3a7c9a2e-4a5e-4b9d-9a4f-8a86c5b4d1a3
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 
      - 'CoCreateInstance'
      - 'IID_IDispatch'
      - 'CLSID:'
      - 'dcom'
      - 'remote'
    ParentImage|endswith: '\svchost.exe'
    Image|endswith: '\rundll32.exe'
  ttp_selection:
    CommandLine|contains|all:
      - 'CoCreateInstance'
      - 'remote'
  condition: selection and not ttp_selection
falsepositives:
  - Legitimate administrative scripts using DCOM (rare in standard user contexts)
  - Software deployment tools leveraging remote COM objects
level: high

⚠ Rules are AI-generated and unvalidated. Test in a safe environment before production use.

Source Articles

Introduction to COM usage by Windows threats

Component Object Model (COM) is a foundational Windows technology increasingly exploited by threat actors for malicious purposes such as persistence, lateral movement, execution, and evasion. Malware families like Qakbot, Gh0stRAT, and WarmCookie leverage COM interfaces to interact with Windows services including Task Scheduler, WMI, and BITS, often bypassing traditional detection mechanisms. These threats use indirect vtable calls and DCOM for stealthy operations, making static analysis more complex. Understanding COM usage is critical for effective threat hunting and reverse engineering.

talos ·1w ago