Skip to content

Hide Navigation Hide TOC

Potential Persistence Via Scrobj.dll COM Hijacking (fe20dda1-6f37-4379-bbe0-a98d400cae90)

Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute

Cluster A Galaxy A Cluster B Galaxy B Level
Potential Persistence Via Scrobj.dll COM Hijacking (fe20dda1-6f37-4379-bbe0-a98d400cae90) Sigma-Rules Component Object Model Hijacking - T1546.015 (bc0f5e80-91c0-4e04-9fbb-e4e332c85dae) Attack Pattern 1
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern Component Object Model Hijacking - T1546.015 (bc0f5e80-91c0-4e04-9fbb-e4e332c85dae) Attack Pattern 2