# Windows Components Object Model
## **Known Techniques**
### **COM Hijacking**
{% hint style="info" %}
[T1546.015](https://attack.mitre.org/techniques/T1546/015/) - Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
{% endhint %}
### **COM Elevation of Privilege - UAC Bypass**
{% hint style="info" %}
[T1548.002](https://attack.mitre.org/techniques/T1548/002/) - Abuse Elevation Control Mechanism: Bypass User Account Control
Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box. An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access.
{% endhint %}
### **Lateral Movement with DCOM**
{% hint style="info" %}
[T1021.003](https://attack.mitre.org/techniques/T1021/003/) - Remote Services: Distributed Component Object Model
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.
{% endhint %}
### **Code Execution**
{% hint style="info" %}
[T1559.001](https://attack.mitre.org/techniques/T1559/001/) - Inter-Process Communication: Component Object Model
Adversaries may use various COM objects to achieve their goals, some of their goals can be, Arbitrary code execution, Creating Schedules Tasks, Modification of Registry or Files, etc.
{% endhint %}
## COM / DCOM reading material
### Main Source
*
{% content-ref url="/pages/XSoqZbt69ifuYLeZhW84" %}
[Demystifying Windows Component Object Model (COM)](/offensive-security/windows-components-object-model/demystifying-windows-component-object-model-com.md)
{% endcontent-ref %}
{% content-ref url="/pages/OVbY2XjvkWwh9i9NZDzb" %}
[COM Hijacking - T1546.015](/offensive-security/windows-components-object-model/com-hijacking-t1546.015.md)
{% endcontent-ref %}
### General COM Internals
*
*
*
*
*
*
*
*
### COM Hijacking / Persistence
*
*
*
*
*
### DCOM Lateral Movement
*
*
*
*
*
*
*
*
*
### COM Privilege Escalation / UAC Bypasses
*
*
*
*
*
*
*
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://www.221bluestreet.com/offensive-security/windows-components-object-model.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.