Component Object Model Hijacking

registry where host.os.type == "windows" and event.type == "change" and
  /* not necessary but good for filtering privileged installations */
  user.domain != "NT AUTHORITY" and process.executable != null and 
  (
    (
      registry.path : "HK*\\InprocServer32\\" and
      registry.data.strings: ("scrobj.dll", "?:\\*\\scrobj.dll") and
      not registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*"
    ) or

    (
      registry.path : "HKLM\\*\\InProcServer32\\*" and
        registry.data.strings : ("*\\Users\\*", "*\\ProgramData\\*")
    ) or

    /* in general COM Registry changes on Users Hive is less noisy and worth alerting */
    (
      registry.path : (
        "HKEY_USERS\\*\\InprocServer32\\",
        "HKEY_USERS\\*\\LocalServer32\\",
        "HKEY_USERS\\*\\DelegateExecute",
        "HKEY_USERS\\*\\TreatAs\\",
        "HKEY_USERS\\*\\ScriptletURL*", 
        "HKEY_USERS\\*\\TypeLib*\\Win*"
      ) and
      not registry.data.strings : (
            /* COM related to Windows Spotlight feature */
            "{4813071a-41ad-44a2-9835-886d2f63ca30}",

            /* AppX/MSIX DelegateExecute handlers: execute, protocol, file */
            "{A56A841F-E974-45C1-8001-7E3F8A085917}",
            "{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",
            "{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}"
      )
    )
  ) and 
  
  not (
    process.code_signature.trusted == true and
    process.code_signature.subject_name in (
        "Island Technology Inc.", "Google LLC", "Grammarly, Inc.", "Dropbox, Inc", "REFINITIV US LLC", "HP Inc.", "Adobe Inc.",
        "Citrix Systems, Inc.", "Veeam Software Group GmbH", "Zhuhai Kingsoft Office Software Co., Ltd.", "Oracle America, Inc.",
        "Brave Software, Inc.", "DeepL SE", "Opera Norway AS", "Thomas Braun", "Slack Technologies, LLC", "Spotify AB",
        "Vivaldi Technologies AS"
    )
  ) and 

  /* excludes trusted applications registering their own COM components */
  not (
    process.code_signature.trusted == true and
    (
      (
        process.name : "OneDrive.Sync.Service.exe" and
        process.code_signature.subject_name == "Microsoft Corporation" and
        registry.data.strings : (
          "*\\Microsoft\\OneDrive\\*\\OneDrive.Sync.Service.exe*",
          "*\\Microsoft\\OneDrive\\*\\OneDrive.Sync.Service.dll*"
        )
      ) or
      (
        process.executable : "?:\\Users\\*\\AppData\\Local\\Kingsoft\\WPS Office\\*\\office6\\ksomisc.exe" and
        process.code_signature.subject_name == "WPS SOFTWARE PTE. LTD." and
        registry.data.strings : "*\\Kingsoft\\WPS Office\\*"
      ) or
      (
        process.name : "claude.exe" and
        process.code_signature.subject_name == "Anthropic, PBC" and
        registry.data.strings : (
          "*\\Users\\*\\AppData\\Local\\AnthropicClaude\\app-*\\claude.exe*",
          "*\\ProgramData\\*\\AnthropicClaude\\app-*\\claude.exe*"
        )
      )
    )
  ) and

  /* excludes Microsoft signed noisy processes */
  not
  (
    process.name : (
      "OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe", "MicrosoftEdgeUpdate.exe", "msrdcw.exe",
      "MicrosoftEdgeUpdateComRegisterShell64.exe", "setup.exe", "PowerToys.PowerLauncher.exe"
    ) and
    process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
  ) and
  
  not process.executable : (
        "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
        "?:\\Program Files (x86)\\*.exe",
        "?:\\Program Files\\*.exe",
        "?:\\ProgramData\\4Team\\4Team-Updater\\4Team-Updater-Helper.exe",
        "?:\\ProgramData\\Lenovo\\Udc\\Hosts\\x64\\MessagingPlugin.exe",
        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
        "?:\\Users\\*\\AppData\\Local\\Wondershare\\Wondershare NativePush\\WsToastNotification.exe",
        "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
        "?:\\Windows\\System32\\FMToastNotification.exe",
        "?:\\Windows\\System32\\msiexec.exe",
        "?:\\Windows\\System32\\svchost.exe",
        "?:\\Windows\\SysWOW64\\regsvr32.exe",
        "?:\\Windows\\System32\\regsvr32.exe",
        "\\Device\\Mup\\*\\Kufer\\KuferSQL\\BasysSQL.exe"
  )