{"id":"T1218.012","name":"Verclsid","url":"https://attack.mitre.org/techniques/T1218/012","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0042","stix_id":"x-mitre-detection-strategy--1d738832-3de4-45f0-98e5-ac37642619e8","name":"Detection Strategy for T1218.012 Verclsid Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0042","analytics":[{"id":"AN0118","stix_id":"x-mitre-analytic--e9f451b7-1b9e-420e-983a-3442547b7180","name":"Analytic 0118","description":"Detects abuse of verclsid.exe to execute COM objects by monitoring process creation, CLSID arguments, DLLs or scriptlet engines loaded into memory, and If the CLSID points to remote SCT/HTA content, verclsid.exe makes outbound connections.","url":"https://attack.mitre.org/detectionstrategies/DET0042#AN0118","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AllowedCLSIDs","description":"Baseline CLSIDs frequently invoked by verclsid.exe in normal shell extension verification."},{"field":"ParentProcessFilter","description":"Unusual parents (e.g., winword.exe, excel.exe) spawning verclsid.exe should be treated as suspicious."},{"field":"TimeWindow","description":"Correlation window between verclsid.exe start, module load, and network activity."},{"field":"ExternalIPRange","description":"Restrict detection to external IPs not in approved ranges to cut noise."}],"live":true,"detection_strategies":["DET0042"],"techniques":["T1218.012"]}],"live":true,"version":"1.0","techniques":["T1218.012"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}