Overview

The Component Object Model or COM is a framework built to provide interoperability between software components in a Windows environment. This allows components to interact with each other independently of the language they were written in. Many Windows components like WMI, Microsoft Office and other third party applications expose their functionalities through COM objects.

​

These COM objects may often expose functionalities which allow file creation, process creation and even command execution which makes COM a very interesting target for attackers.

​

This two-hour session begins with an introduction to COM, explaining its architecture and role within Windows, and why it matters from an offensive perspective. Attendees will explore how COM can be abused to achieve a variety of objectives, including code execution, persistence, privilege escalation, and evasion.

​

The session will showcase why COM continues to be attractive to attackers, highlight abuse opportunities, and discuss common techniques used during offensive operations.

​

The talk concludes with a high-level look at detection considerations, helping defenders better understand where malicious COM-related activity may show up within their environments. Finally, attendees will also be introduced to advanced areas of study and related Windows internals topics-to continue their learning beyond the session.