Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1559.001: Component Object Model

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.[1] Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).[2] Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).[1]

Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic.[2] Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.[1][3]

EnterpriseT1559.001Sub-techniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Component Object Model abuse matters because it turns normal Windows inter-process communication into a local execution path. For leaders, the risk is not that COM is inherently malicious, but that it is a built-in Windows capability used by many legitimate applications and also referenced across multiple ATT&CK group and malware relationships. That makes it a coverage-validation problem: can the organization distinguish expected COM-driven execution from suspicious use that may enable follow-on execution, persistence, privilege-related activity, or task creation?

Executive priority

Prioritize this where Windows endpoints support critical operations, privileged administration, sensitive data handling, or regulated audit evidence. Because ATT&CK lists no official detection text for this sub-technique, executives should ask whether SOC and IR teams have a documented detection strategy, whether privileged account activity involving COM-mediated execution is reviewable, and whether isolation/sandboxing controls reduce the blast radius of abused applications.

Technical view

Validate coverage for Windows execution via COM as a sub-technique of Inter-Process Communication under the Execution tactic. ATT&CK notes that COM clients can call server objects implemented as DLLs or EXEs, and that exposed COM interfaces may be abused through languages including C, C++, Java, and Visual Basic. Detection engineering should map DET0224, if available internally, to concrete Windows telemetry and test whether COM-related execution can be correlated with parent process, loaded module or launched executable, scripting context, scheduled task creation, and privileged account use. Relationship context shows this behavior is associated with multiple groups and software entries, so detections should focus on behavior rather than a single tool or actor.

Likely telemetry

  • Windows process creation and parent/child process relationships involving COM client and server execution
  • DLL/module load telemetry for COM server objects where collected
  • Executable launch telemetry for COM server objects implemented as EXEs
  • Script or language runtime telemetry where Visual Basic or other supported languages invoke COM interfaces
  • Scheduled task creation or modification events when COM interfaces are used to create tasks

Detection direction

  • Start by confirming whether DET0224 or an equivalent internal analytic exists for Component Object Model abuse; ATT&CK does not provide official detection text for this object.
  • Baseline legitimate COM-heavy applications before alerting broadly, because COM is a native Windows API used by normal software and can produce high false positives if treated as inherently suspicious.
  • Correlate COM-mediated execution with unusual parent processes, scripting activity, unexpected DLL/EXE server activation, privileged-account context, and follow-on behaviors such as scheduled task creation.
  • Use relationship-driven context for prioritization: ATT&CK links this sub-technique to multiple malware families and groups, but detections should remain behavior-based and not assume attribution.
  • Check blind spots on endpoints without process, module-load, scripting, scheduled-task, or privileged-account telemetry; lack of these sources can make COM abuse difficult to validate during incident response.

Mitigation priorities

  • Apply privileged account management first: restrict administrative permissions, enforce least privilege, and ensure privileged COM-related activity is logged and accountable.
  • Use application isolation and sandboxing where practical to contain applications that may expose or invoke COM interfaces and limit access to sensitive resources.
  • Reduce unnecessary administrative exposure on Windows systems that support critical business functions.
  • Validate that control evidence is audit-ready: privileged account policies, logging coverage, and isolation decisions should be documented for compliance and incident review.
  • Pair prevention with monitoring, because COM is a legitimate Windows mechanism and cannot generally be disabled without business impact.
Analyst notes and limits

This take is based on ATT&CK T1559.001 in enterprise-attack, Windows platform, Execution tactic, the supplied description, external reference list, and relationships. The relationship set includes DET0224 as a detection strategy, M1026 Privileged Account Management, M1048 Application Isolation and Sandboxing, parent technique T1559, and multiple group/software uses. Those relationships support prioritizing behavior-based detection and privileged-use review, not making claims about current activity in any specific environment.

The official ATT&CK detection field is not provided, so telemetry and detection guidance must be validated locally against available Windows endpoint, EDR, logging, and administrative audit data. The supplied fields do not provide vendor-specific controls, exact event IDs, or a complete list of suspicious COM objects; local baselining is required.

Official MITRE ATT&CK definition

Component Object Model

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.[1] Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).[2] Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).[1]

Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic.[2] Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.[1][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1559 Inter-Process Communication This object subtechnique of Inter-Process Communication.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Group Enterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Group Enterprise

G1051: Medusa Group

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” [1] [2] Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. [3] For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. [4]

Malware Enterprise

S0266: TrickBot

TrickBot is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to Dyre. TrickBot was developed and initially used by Wizard Spider for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of "big game hunting" ransomware campaigns.[1][2][3][4]

Windows
Malware Enterprise

S0260: InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]

Windows
Malware Enterprise

S0386: Ursnif

Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, Spearphishing Attachments, and malicious links.[1][2] Ursnif is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.[3]

Windows
Malware Enterprise

S1160: Latrodectus

Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.[1][2][3]

Windows
Malware Enterprise

S1130: Raspberry Robin

Raspberry Robin is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. Raspberry Robin has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as SocGholish, Cobalt Strike, IcedID, and Bumblebee.[1][2][3] The DLL componenet in the Raspberry Robin infection chain is also referred to as "Roshtyak."[4] The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.[5]

Windows
Relationship explorer

All related ATT&CK context

uses · Malware S0223: POWERSTATS Enterprise uses · Malware S0266: TrickBot Enterprise uses · Malware S1236: CLAIMLOADER Enterprise uses · Group G0094: Kimsuky Enterprise uses · Malware S0260: InvisiMole Enterprise uses · Malware S1044: FunnyDream Enterprise uses · Group G0069: MuddyWater Enterprise uses · Malware S0386: Ursnif Enterprise uses · Malware S1015: Milan Enterprise uses · Malware S1160: Latrodectus Enterprise mitigates · Mitigation M1026: Privileged Account Management Enterprise uses · Group G0047: Gamaredon Group Enterprise mitigates · Mitigation M1048: Application Isolation and Sandboxing Enterprise uses · Group G1051: Medusa Group Enterprise uses · Malware S1130: Raspberry Robin Enterprise uses · Malware S0698: HermeticWizard Enterprise uses · Malware S9037: RustyWater Enterprise uses · Malware S1066: DarkTortilla Enterprise uses · Malware S0691: Neoichor Enterprise uses · Tool S0692: SILENTTRINITY Enterprise subtechnique of · Technique T1559: Inter-Process Communication Enterprise uses · Malware S1238: STATICPLUGIN Enterprise detects · Detection Strategy DET0224: Detect Abuse of Component Object Model (T1559.001) Enterprise uses · Malware S1039: Bumblebee Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1026: Privileged Account Management

Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures:

Account Permissions and Roles:

- Implement RBAC and least privilege principles to allocate permissions securely. - Use tools like Active Directory Group Policies to enforce access restrictions.

Credential Security:

- Deploy password vaulting tools like CyberArk, HashiCorp Vault, or KeePass for secure storage and rotation of credentials. - Enforce password policies for complexity, uniqueness, and expiration using tools like Microsoft Group Policy Objects (GPO).

Multi-Factor Authentication (MFA):

- Enforce MFA for all privileged accounts using Duo Security, Okta, or Microsoft Azure AD MFA.

Privileged Access Management (PAM):

- Use PAM solutions like CyberArk, BeyondTrust, or Thycotic to manage, monitor, and audit privileged access.

Auditing and Monitoring:

- Integrate activity monitoring into your SIEM (e.g., Splunk or QRadar) to detect and alert on anomalous privileged account usage.

Just-In-Time Access:

- Deploy JIT solutions like Azure Privileged Identity Management (PIM) or configure ephemeral roles in AWS and GCP to grant time-limited elevated permissions.

*Tools for Implementation*

Privileged Access Management (PAM):

- CyberArk, BeyondTrust, Thycotic, HashiCorp Vault.

Credential Management:

- Microsoft LAPS (Local Admin Password Solution), Password Safe, HashiCorp Vault, KeePass.

Multi-Factor Authentication:

- Duo Security, Okta, Microsoft Azure MFA, Google Authenticator.

Linux Privilege Management:

- sudo configuration, SELinux, AppArmor.

Just-In-Time Access:

- Azure Privileged Identity Management (PIM), AWS IAM Roles with session constraints, GCP Identity-Aware Proxy.

Mitigation Enterprise

M1048: Application Isolation and Sandboxing

Application Isolation and Sandboxing refers to the technique of restricting the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox). This method prevents potentially malicious code from affecting the rest of the system or network by limiting access to sensitive resources and critical operations. The goal is to contain threats and minimize their impact. This mitigation can be implemented through the following measures:

Browser Sandboxing:

- Use Case: Implement browser sandboxing to isolate untrusted web content and prevent malicious web pages or scripts from accessing sensitive system resources or initiating unauthorized downloads. - Implementation: Use browsers with built-in sandboxing features (e.g., Google Chrome, Microsoft Edge) or deploy enhanced browser security frameworks that limit the execution scope of active content. Consider controls that monitor or restrict script-based file generation and downloads commonly abused in evasion techniques like HTML smuggling.

Application Virtualization:

- Use Case: Deploy critical or high-risk applications in a virtualized environment to ensure any compromise does not affect the host system. - Implementation: Use application virtualization platforms to run applications in isolated environments.

Email Attachment Sandboxing:

- Use Case: Route email attachments to a sandbox environment to detect and block malware before delivering emails to end-users. - Implementation: Integrate security solutions with sandbox capabilities to analyze email attachments.

Endpoint Sandboxing:

- Use Case: Run all downloaded files and applications in a restricted environment to monitor their behavior for malicious activity. - Implementation: Use endpoint protection tools for sandboxing at the endpoint level.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
30012659e38ceb4c...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle 30012659e38c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Fireeye Hunting COM June 2019

    Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.

    Open source URL
  2. [2]
    Microsoft COM

    Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017.

    Open source URL
  3. [3]
    ProjectZero File Write EoP Apr 2018

    Forshaw, J. (2018, April 18). Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege. Retrieved May 3, 2018.

    Open source URL
  4. [4]
    Enigma MMC20 COM Jan 2017

    Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017.

    Open source URL
  5. [5]
    Enigma Outlook DCOM Lateral Movement Nov 2017

    Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.

    Open source URL
  6. [6]
    mitre-attack T1559.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use