> For the complete documentation index, see [llms.txt](https://www.221bluestreet.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.221bluestreet.com/offensive-security/windows-components-object-model.md).
# Windows Components Object Model
## **Known Techniques**
### **COM Hijacking**
{% hint style="info" %}
[T1546.015](https://attack.mitre.org/techniques/T1546/015/) - Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
{% endhint %}
### **COM Elevation of Privilege - UAC Bypass**
{% hint style="info" %}
[T1548.002](https://attack.mitre.org/techniques/T1548/002/) - Abuse Elevation Control Mechanism: Bypass User Account Control
Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box. An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access.
{% endhint %}
### **Lateral Movement with DCOM**
{% hint style="info" %}
[T1021.003](https://attack.mitre.org/techniques/T1021/003/) - Remote Services: Distributed Component Object Model
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.
{% endhint %}
### **Code Execution**
{% hint style="info" %}
[T1559.001](https://attack.mitre.org/techniques/T1559/001/) - Inter-Process Communication: Component Object Model
Adversaries may use various COM objects to achieve their goals, some of their goals can be, Arbitrary code execution, Creating Schedules Tasks, Modification of Registry or Files, etc.
{% endhint %}
## COM / DCOM reading material
### Main Source
*
{% content-ref url="/pages/XSoqZbt69ifuYLeZhW84" %}
[Demystifying Windows Component Object Model (COM)](/offensive-security/windows-components-object-model/demystifying-windows-component-object-model-com.md)
{% endcontent-ref %}
{% content-ref url="/pages/OVbY2XjvkWwh9i9NZDzb" %}
[COM Hijacking - T1546.015](/offensive-security/windows-components-object-model/com-hijacking-t1546.015.md)
{% endcontent-ref %}
### General COM Internals
*
*
*
*
*
*
*
*
### COM Hijacking / Persistence
*
*
*
*
*
### DCOM Lateral Movement
*
*
*
*
*
*
*
*
*
### COM Privilege Escalation / UAC Bypasses
*
*
*
*
*
*
*