COMouflage - COM-based DLL Surrogate Injection

项目说明

COMouflage

COM-based DLL Surrogate Injection

Abstract

This paper analyzes a sophisticated injection technique that le the Component Object Model (COM) and DLL Surrogate processes for stealthy code execution. Unlike traditional COM hijacking methods focused primarily on persistence, this technique exploits the surrogate hosting capabilities to achie injection with several operational ad, including parent process masquerading and reduced detection footprint.

1. Introduction

Component Object Model (COM) hijacking has been extensively documented as a persistence mechanism in the MITRE ATT&CK framework. This paper examines the technical mechanics of COM-based DLL Surrogate injection.

2. Technical Background

2.1 What is COM?

The Component Object Model (COM) is a Microsoft technology that enables software components to communicate regardless of the programming language used to create them. COM objects are identified by globally unique identifiers (GUIDs) called Class Identifiers (CLSIDs) and can be instantiated through mechanisms including:

2.2 Understanding dllhost.exe and DLL Surrogates

dllhost.exe is a legitimate Windows system process that serves as a surrogate host for COM objects implemented as DLLs. This mechanism, known as “DLL Surrogate,” allows DLL-based COM objects to run in a separate process space, pro:

The surrogate is configured through registry entries, specifically the DllSurrogate value under the AppID registry key.

3. Attack Technique Analysis

3.1 Registry Manipulation for HKCU Hijacking

The technique operates by creating specific registry entries in HKEY_CURRENT_USER rather than HKEY_LOCAL_MACHINE, which provides several ad:

1. Reduced pri required: No administrator rights needed
1. User-specific targeting: Affects only the current user context
1. Stealth: Less likely to be monitored compared to HKLM modifications

#### Registry Structure Created:

3.2 Process Tree Masquerading

When the malicious COM object is instantiated with CLSCTX_LOCAL_SERVER, Windows automatically launches dllhost.exe as a surrogate process. This creates a decepti tree:

Key Ad:

4. Detailed Code Analysis

4.1 CLSID Definition and Constants

The technique begins with a custom CLSID (Class Identifier), a 128-bit GUID that uniquely identifies the COM object. This particular CLSID is crafted to appear distincti a conflicts with legitimate system components. The format follows the standard GUID structure: {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}.

4.2 Registry Manipulation Function

Technical Breakdown:

1. RegCreateKeyExW: Creates or opens the specified registry key with KEY_WRITE permissions
1. Error Handling: Each registry operation includes proper error checking
1. REG_OPTION_NON_: Ensures the key persists across reboots -> Could be changed with REG_OPTION_ (Stored in memory and is not preserved when the corresponding registry hive is unloaded)

4.3 AppID Registry Configuration

Critical Analysis:

4.4 CLSID Registry Configuration

Registry Structure Explanation:

1. CLSID Root: HKCU\Software\Classes\CLSID\{CLSID}

4.5 COM Initialization and Object Creation

Technical Details:

4.6 Critical Injection Trigger

The CLSCTX_LOCAL_SERVER Significance:

4.7 Process Flow Analysis

Execution Sequence:

1. Registry entries created in HKCU
1. COM system initialized
1. CoCreateInstance called with CLSCTX_LOCAL_SERVER
1. Windows COM Service Control Manager (SCM) processes the request
1. SCM detects DllSurrogate value and launches dllhost.exe
1. dllhost.exe loads the specified DLL from InprocServer32
1. Malicious code executes within the surrogate process context

Result: The malicious DLL runs in dllhost.exe with s.exe as apparent parent, obscuring the true attack .

5. COMouflage EDR's

In this e, four leading Endpoint Detection and Response (EDR) solutions were examined without disclosing identities. The goal was to assess how these solutions react to COMouflage-based surrogate execution.
During testing, one solution registered dllhost.exe activity but failed to classify it as suspicious, resulting in no alert being raised. Other solutions similarly did not detect the surrogate execution technique, allowing the process to run without generating any form of warning or inter.
These obser highlight significant detection blind spots across multiple industry-standard platforms and underscore the need for impro analysis capabilities within modern EDR technologies.

6. Conclusion

COM-based DLL Surrogate injection represents an e of traditional COM hijacking techniques, offering ad enhanced stealth capabilities through process tree masquerading. The technique’s reliance on legitimate Windows functionality makes detection challenging but not impossible with proper monitoring and forensic awareness.
This technique highlights the importance of understanding legitimate Windows mechanisms that can be sub for malicious purposes.

7. References

[1]

[2]

[3]

[4]

[5]

项目信息

开发语言：C++

Star 数：198

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕COM-based DLL Surrogate Injection展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。