Techniques › T1218.012 › AN0118
AN0118 Analytic 0118
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects abuse of verclsid.exe to execute COM objects by monitoring process creation, CLSID arguments, DLLs or scriptlet engines loaded into memory, and If the CLSID points to remote SCT/HTA content, verclsid.exe makes outbound connections.</p>
- Detects
- T1218.012 Verclsid
- Part of
- DET0042 Detection Strategy for T1218.012 Verclsid Abuse
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedCLSIDs | Baseline CLSIDs frequently invoked by verclsid.exe in normal shell extension verification. |
ParentProcessFilter | Unusual parents (e.g., winword.exe, excel.exe) spawning verclsid.exe should be treated as suspicious. |
TimeWindow | Correlation window between verclsid.exe start, module load, and network activity. |
ExternalIPRange | Restrict detection to external IPs not in approved ranges to cut noise. |