com-proxy-triage

High-risk offensive behavior: this script actively performs COM InprocServer32 hijacking in HKCU by generating proxy DLLs (NetClone.exe-based) and writing COM registration overrides, then triggers and validates execution by launching a target process and capturing evidence. While it attempts cleanup by restoring HKCU registry keys afterward, the functionality is directly aligned with exploitation and could be used maliciously. Confidence is limited to this fragment because it dot-sources additional scripts not included here.

This DLL contains multiple strong malware-loader characteristics: it spawns a thread on DLL_PROCESS_ATTACH and attempts to execute an external process via CreateProcessW using a substituted payload command, and (when compiled with _REBUILD) it loads another DLL and performs IAT/export table patching with RWX trampoline stubs for code redirection. These behaviors are consistent with backdoor/loader functionality typical of supply-chain attacks.

High suspicion of malicious payload generation. The script overwrites native source code to embed a user-controlled command ($PayloadCommand) and process-based guard logic ($TargetProcesses), then compiles and outputs a DLL using MSBuild (likely for COM hijacking). It also temporarily manipulates PATH and restores source after building, reducing traces. This strongly matches a supply-chain/payload-creation or offensive tooling pattern rather than benign dependency code.

This module is highly consistent with generating and building a conditional DLL loader/payload intended for DLL proxy/hijacking-style behavior. It embeds explicit LoadLibraryW execution (hardcoded DLL path), gates activation using process-name checks and a named mutex, compiles the loader via MSBuild after temporarily altering the build environment, and then uses NetClone to clone exports from a caller-supplied reference DLL to impersonate legitimate exports. Treat as high risk in a supply-chain context and do not use without strong provenance, sandboxing, and end-to-end behavior verification.

SUSPICIOUS. The skill is internally coherent for COM hijack research, but that purpose itself is a high-risk offensive capability for an AI agent. The main security concerns are registry-based system modification, payload/proxy execution, PowerShell policy bypass, and reliance on third-party Koppeling/NetClone tooling with weak provenance compared with the otherwise legitimate Microsoft toolchain dependencies.

This module fragment is a high-suspicion orchestrator for a COM hijacking workflow: it reads target app names from a JSON manifest and, for each target, executes a technique-focused helper script with an attacker-controllable payload command and additional execution-control parameters. While the actual malicious/persistence actions are likely implemented inside the invoked helper (not shown), the wrapper’s structure and payload injection pathway make it inappropriate for untrusted use. Recommend treating the package as potentially malicious until the helper script (Invoke-ComHijackApp.ps1) is reviewed and executed only in a controlled environment with input validation and integrity verification.

This code fragment describes an end-to-end COM InProcServer32 hijacking automation: it discovers CLSID candidates via ETW, builds a proxy/payload DLL, clones exports for compatibility, writes HKCU InProcServer32 overrides (and ThreadingModel), launches a target process to trigger in-proc COM loading, verifies whether the payload fired, and records results with rollback/cleanup. The workflow is strongly indicative of malicious exploitation capability rather than legitimate functionality.

This is a high-risk orchestrator wrapper: it dot-sources and then executes companion scripts with a caller-supplied payload command and process-impact controls, consistent with COM-hijack probing/exploitation testing. While this fragment itself shows no direct exfiltration or credential theft, the ability to forward an arbitrary payload into executed code and the COM-hijack context warrant treating the package as suspicious until the dot-sourced module and probe script are reviewed for malicious execution/persistence behavior. Recommend inspecting the companion scripts for process execution, registry/COM changes, persistence mechanisms, and any network/data collection.