CVE-2026-66804: Windows Dangling COM Object Elevation of Privilege — Detection and Remediation Guide

---
title: Per-User COM Registration Shadowing CrossDevice CLSID
id: 3f7a2b91-6c4e-4d28-9a15-8e2c0b1d4f67
status: experimental
description: Detects creation or modification of a per-user COM InprocServer32 registration for the CrossDevice CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, which shadows the system-wide dangling registration and is consistent with exploitation of CVE-2026-66804 / dangling COM object privilege escalation.
references:
  - https://projectzero.google/2026/09/windows-dangling-com.html
  - https://attack.mitre.org/techniques/T1546/015/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1546.015
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - 'HKU\\Classes\\CLSID\\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}'
      - 'HKCU\\SOFTWARE\\Classes\\CLSID\\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}'
      - 'SOFTWARE\\Classes\\CLSID\\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}\\InprocServer32'
  filter_system_key:
    TargetObject|startswith: 'HKLM\\SOFTWARE\\Classes\\CLSID\\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}'
    Image|endswith:
      - '\\svchost.exe'
      - '\\TiWorker.exe'
      - '\\msiexec.exe'
  condition: selection and not filter_system_key
falsepositives:
  - Rare; per-user registration of a system-shipped CrossDevice CLSID is not expected from legitimate software
level: high
---
title: Suspicious DLL Load Referenced By User-Writable InprocServer32 Path
id: 91c4e6a2-3b7d-4f18-a652-0d9e1c8b2a34
status: experimental
description: Detects DLL image loads from user-writable locations (AppData, Temp, Public, user profile) by high-integrity Windows service processes, consistent with a planted COM server DLL being activated in a privileged context via a dangling or hijacked COM registration.
references:
  - https://projectzero.google/2026/09/windows-dangling-com.html
  - https://attack.mitre.org/techniques/T1546/015/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.privilege_escalation
  - attack.t1546.015
logsource:
  category: image_load
  product: windows
detection:
  selection_paths:
    ImageLoaded|contains:
      - '\\AppData\\'
      - '\\Users\\Public\\'
      - '\\Temp\\'
      - '\\Downloads\\'
  selection_hosts:
    Image|endswith:
      - '\\svchost.exe'
      - '\\dllhost.exe'
      - '\\explorer.exe'
  condition: selection_paths and selection_hosts
falsepositives:
  - Legitimate per-user applications loading plugins; tune by excluding known-signed paths in your environment
  - Some enterprise software installs per-user COM servers legitimately — baseline before enforcing
level: medium
---
title: Registry Write To Dangling COM CLSID InprocServer32 By Non-Installer Process
id: 5b8d3f07-2a49-4e61-b734-c1a6f0e9d2b8
status: experimental
description: Detects any InprocServer32 value write under a CLSID key performed by a process that is not a known installer or servicing binary. Generic detection for the dangling COM registration bug class that produced CVE-2026-66804 and CVE-2026-50343.
references:
  - https://projectzero.google/2026/09/windows-dangling-com.html
  - https://attack.mitre.org/techniques/T1546/015/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1546.015
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\\CLSID\\{'
      - '\\InprocServer32'
    TargetObject|endswith: '(Default)'
  filter_installers:
    Image|endswith:
      - '\\msiexec.exe'
      - '\\TiWorker.exe'
      - '\\TrustedInstaller.exe'
      - '\\svchost.exe'
      - '\\regsvr32.exe'
      - '\\setup.exe'
  condition: selection and not filter_installers
falsepositives:
  - Software development activity (building/registering COM components on dev workstations) — scope exclusions by host group
  - Line-of-business apps that self-register COM components at runtime
level: medium

// Hunt for registry manipulation of the CrossDevice dangling CLSID or per-user COM shadow registrations
let TargetClsid = "E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496";
let InstallerProcs = dynamic(["msiexec.exe","TiWorker.exe","TrustedInstaller.exe","svchost.exe","regsvr32.exe"]);
union isfuzzy=true
(DeviceRegistryEvents
 | where RegistryKey has TargetClsid
 | where InitiatingProcessFileName !in~ (InstallerProcs)
 | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
           InitiatingProcessCommandLine, ActionType, RegistryKey, RegistryValueName, RegistryValueData
 | extend HuntReason = "Write to CrossDevice CLSID registration"),
(DeviceRegistryEvents
 | where RegistryKey has @"SOFTWARE\Classes\CLSID" and RegistryKey endswith @"InprocServer32"
 | where InitiatingProcessFileName !in~ (InstallerProcs)
 | where RegistryKey startswith @"HKEY_CURRENT_USER" or RegistryKey has @"HKEY_USERS\S-1-5-21"
 | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
           InitiatingProcessCommandLine, ActionType, RegistryKey, RegistryValueName, RegistryValueData
 | extend HuntReason = "Per-user COM server registration by non-installer process")
| order by TimeGenerated desc

-- Hunt: Dangling or hijacked InprocServer32 COM registrations (CVE-2026-66804 bug class)
LET regs = SELECT Key.FullPath AS ClsidKey,
                  Data.value AS ServerDll
           FROM read_reg_key(glob='HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\*\\InprocServer32',
                             accessor='registry')
           WHERE Data.value

SELECT ClsidKey,
       ServerDll,
       expand(path=ServerDll) AS ExpandedDll,
       stat(filename=expand(path=ServerDll)) IS NOT NULL AS DllExists,
       ExpandedDll =~ '(?i)\\\\(users|programdata)\\\\.*(appdata|temp|public|downloads)' AS UserWritablePath
FROM regs
WHERE DllExists = FALSE
   OR UserWritablePath = TRUE
ORDER BY DllExists ASC

# CVE-2026-66804 verification and audit script
# Run as Administrator. Checks patch state, audits the CrossDevice CLSID,
# and scans for per-user shadow registrations across all loaded user hives.

$Clsid = '{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}'
$report = [ordered]@{}

# 1. Check OS build against September 2026 security update baseline.
#    Confirm the exact minimum build for your SKU in the MSRC advisory for CVE-2026-66804.
$os = Get-CimInstance Win32_OperatingSystem
$build = [version]"$($os.BuildNumber).$((Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR)"
$report['OSBuild'] = $build.ToString()
Write-Host "[*] OS Build: $build  -- verify against MSRC CVE-2026-66804 minimum patched build" -ForegroundColor Cyan

# 2. Check installed hotfixes from Sept 2026 onward
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2026-09-01') }
$report['Sept2026Hotfixes'] = ($hotfixes | ForEach-Object { $_.HotFixID }) -join ', '
if (-not $hotfixes) { Write-Host '[!] No hotfixes installed since 2026-09-01 — host likely UNPATCHED' -ForegroundColor Red }

# 3. Audit the system-wide CrossDevice CLSID registration
$sysKey = "HKLM:\SOFTWARE\Classes\CLSID\$Clsid\InprocServer32"
if (Test-Path $sysKey) {
    $dll = (Get-ItemProperty $sysKey).'(default)'
    $expanded = [Environment]::ExpandEnvironmentVariables($dll)
    $exists = Test-Path $expanded
    $report['SystemRegistration'] = "Present -> $dll (Exists: $exists)"
    if (-not $exists) {
        Write-Host "[!] DANGLING registration present: $dll does not exist on disk." -ForegroundColor Red
        Write-Host '    Host is vulnerable or incompletely patched. Apply the Sept 2026+ cumulative update.' -ForegroundColor Red
    } else {
        $sig = Get-AuthenticodeSignature $expanded
        Write-Host "[+] Server DLL exists. Signature status: $($sig.Status) ($($sig.SignerCertificate.Subject))" -ForegroundColor Green
        if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'Microsoft') {
            Write-Host '[!] WARNING: non-Microsoft-signed DLL in system COM registration — investigate for hijack.' -ForegroundColor Red
        }
    }
} else {
    Write-Host '[+] System-wide CrossDevice CLSID not present (expected on patched systems).' -ForegroundColor Green
}

# 4. Scan all user hives for per-user shadow registrations of this CLSID
Write-Host '[*] Scanning user hives for shadow COM registrations...' -ForegroundColor Cyan
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' | ForEach-Object {
    $sid = $_.PSChildName
    $userKey = "Registry::HKEY_USERS\$sid\SOFTWARE\Classes\CLSID\$Clsid"
    if (Test-Path $userKey) {
        $dll = (Get-ItemProperty "$userKey\InprocServer32" -ErrorAction SilentlyContinue).'(default)'
        Write-Host "[!] SHADOW REGISTRATION FOUND: SID $sid -> $dll" -ForegroundColor Red
        Write-Host '    Preserve evidence (export key, hash DLL) before removal. Treat as potential compromise.' -ForegroundColor Red
    }
}

# 5. Optional hardening: enable Sysmon registry events (12/13/14) and forward to SIEM
#    if not already collecting — these power the Sigma rules in this post.
Write-Host '[*] Ensure Sysmon registry-set telemetry and MDE registry events are enabled fleet-wide.' -ForegroundColor Cyan

$report | Format-List