Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as  [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)

Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
Component Object Model
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1559/001  external_id: T1559.001     source_name: Fireeye Hunting COM June 2019  description: Hamilton, C. (2019, June 4). Hunting COM Objects. Retrieved June 10, 2019.  url: https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html     source_name: Microsoft COM  description: Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017.  url: https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx     source_name: ProjectZero File Write EoP Apr 2018  description: Forshaw, J. (2018, April 18). Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege. Retrieved May 3, 2018.  url: https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html     source_name: Enigma Outlook DCOM Lateral Movement Nov 2017  description: Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.  url: https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/     source_name: Enigma MMC20 COM Jan 2017  description: Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017.  url: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/     