MITRE ATT&CKsub-technique

T1559.001 Component Object Model

Published 2020-02-12 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Windows
Version
1.2
Created
2020-02-12

Description

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM). Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic. Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1559 Inter-Process Communication technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1048 Application Isolation and Sandboxing mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (22)

  • S9037 RustyWater software (malware)
  • G1051 Medusa Group group
  • S1236 CLAIMLOADER software (malware)
  • S1238 STATICPLUGIN software (malware)
  • S1160 Latrodectus software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1066 DarkTortilla software (malware)
  • S1044 FunnyDream software (malware)
  • S1039 Bumblebee software (malware)
  • S1015 Milan software (malware)
  • S0698 HermeticWizard software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0691 Neoichor software (malware)
  • S0666 Gelsemium software (malware)
  • S0458 Ramsay software (malware)
  • G0094 Kimsuky group
  • S0386 Ursnif software (malware)
  • S0260 InvisiMole software (malware)
  • S0266 TrickBot software (malware)
  • G0069 MuddyWater group
  • S0223 POWERSTATS software (malware)
  • G0047 Gamaredon Group group

Referenced by Compliance · mitigates (13)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SC-18 Mobile Code NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control

References