Threat intelligence / Mitigation

Distributed Component Object Model Mitigation

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AppID_GUID} associated with the process-wide security of individual COM applications. (Citation: Microsoft Process Wide Com Keys) Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security. (Citation: Microsoft System Wide Com Keys) (Citation: Microsoft COM ACL) Consider disabling DCOM through Dcomcnfg.exe. (Citation: Microsoft Disable DCOM) Enable Windows firewall, which prevents DCOM instantiation by default. Ensure all COM alerts and Protected View are enabled. (Citation: Microsoft Protected View)

Mitigation

TypeMitigation

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AppID_GUID} associated with the process-wide security of individual COM applications. (Citation: Microsoft Process Wide Com Keys) Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security. (Citation: Microsoft System Wide Com Keys) (Citation: Microsoft COM ACL) Consider disabling DCOM through Dcomcnfg.exe. (Citation: Microsoft Disable DCOM) Enable Windows firewall, which prevents DCOM instantiation by default. Ensure all COM alerts and Protected View are enabled. (Citation: Microsoft Protected View)

0 recorded

Relationships

No relationships recorded.

6 external

References

mitre-attack

T1175

Microsoft Process Wide Com Keys

https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx

Microsoft System Wide Com Keys

https://msdn.microsoft.com/en-us/library/windows/desktop/ms694331(v=vs.85).aspx

Microsoft COM ACL

https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1

Microsoft Disable DCOM

https://technet.microsoft.com/library/cc771387.aspx

Microsoft Protected View

https://support.office.com/en-us/article/What-is-Protected-View-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653