Windows Exploitation Techniques: Dangling COM Object Registrations
CVE-2026-66804 enables local privilege escalation to SYSTEM via a dangling CrossDevice COM object registration, exploited by planting a DLL and abusing custom COM marshaling through the Shell Create Object Handler service. An incomplete fix for CVE-2026-50343 leaves a dangling COM registration for CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} pointing to a missing DLL in the user-writable C:\ProgramData directory. An attacker plants a malicious DLL at that path, then uses custom COM marshaling to load it into a SYSTEM-level COM service that does not disable custom marshaling. The Shell Create Object Handler service (started via a user-accessible scheduled task) serves as the privileged target.
Detection / Hunteropenrouter
Immediate Actions
- Apply the Microsoft patch for CVE-2026-66804 to all Windows endpoints.
- Hunt for DLL files at %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll on all endpoints.
- Block non-admin users from starting the CreateObjectTask scheduled task.
Key Takeaways
- Dangling COM registration points to %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a writable path with no existing DLL.
- Shell Create Object Handler (CLSID 135fd325-45b7-4c30-89f8-4386961669f0) runs as SYSTEM and permits custom marshaling.
- CreateObjectTask scheduled task is user-startable and requires a global named event to keep the service alive.
- ICreateObject interface accepts an IUnknown pointer, enabling injection of a fake marshaled object into the SYSTEM process.
- PowerShell script provided to enumerate all dangling in-process COM classes in the machine hive.
Attack Chain
- DLL Planting: Attacker creates malicious DLL at %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll
- Service Activation: Attacker creates global named event and starts CreateObjectTask scheduled task
- COM Marshaling: Attacker sends custom OBJREF with dangling CLSID to Shell Create Object Handler via ICreateObject
- Code Execution: COM runtime unmarshals object, loads planted DLL into SYSTEM process
Affected Systems
- Windows systems with CrossDevice COM registration (unpatched)
- Windows 8 through Windows 11 25H2
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-66804 | Windows COM (CrossDevice COM object) | High | Dangling COM object registration enables local privilege escalation via DLL planting. |
| CVE-2026-50343 | Windows COM (CrossDevice / InstallService) | High | Original 'Dark Elevator' bug with weak registry permissions on COM installer plugin. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | DLL creation, scheduled task execution, and named event creation are visible but COM marshaling internals are not. |
| Network Visibility | None | Exploitation is entirely local with no network communication required. |
| Detection Difficulty | Moderate | Individual indicators are visible but linking DLL creation to COM marshaling requires correlation across multiple log sources. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| DLL files created in C:\ProgramData\CrossDevice\ directory by non-system users indicate exploitation of the dangling COM registration (T1574.001). | Sysmon Event ID 11 file creation events | Persistence | Low — path is non-standard and DLL should not exist. |
| CreateObjectTask scheduled task started by non-admin users indicates attempt to activate the SYSTEM COM service (T1053.005). | Task Scheduler operational log, Event ID 4688 | Execution | Medium — legitimate system maintenance may trigger this task. |
| Creation of Global\ShellCreateObjectTaskReadyEvent named event by non-system processes indicates attacker keeping service alive (T1546). | Sysmon Event ID 17/18 named object events | Execution | Low — event name is specific to exploitation workflow. |
| dllhost.exe running as SYSTEM loading CrossDevice.Streaming.Source.dll indicates successful COM hijacking (T1574). | Sysmon Event ID 7 image loaded events | Privilege Escalation | Low — DLL should not exist on patched or clean systems. |
Required Log Sources
- Sysmon Event ID 11 (File Creation)
- Sysmon Event ID 7 (Image Loaded)
- Windows Task Scheduler logs
- Sysmon Event ID 17/18 (Named Pipe/Event)
- Process creation logs (Event ID 4688)
Key Behavioral Indicators
- File creation at %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll
- CreateObjectTask scheduled task started by non-admin user
- Creation of Global\ShellCreateObjectTaskReadyEvent named event
- dllhost.exe (SYSTEM) loading CrossDevice.Streaming.Source.dll
- COM object instantiation with CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}
Control Gaps
- Standard AV signatures will not detect DLL planting at a legitimate-looking path.
- Application whitelisting may not block DLLs loaded via COM marshaling into trusted processes.
- Registry monitoring may not flag pre-existing dangling COM registrations as malicious.
False Positive Assessment
Low — DLL presence at the CrossDevice path is anomalous; CreateObjectTask started by non-admin users is uncommon in normal operations.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict write permissions on C:\ProgramData\CrossDevice\ directory to administrators only.
- Enable EOAC_NO_CUSTOM_MARSHAL on all custom COM services where feasible.
- Audit and remove dangling COM registrations in the machine hive using the provided PowerShell script.
User Protection
- Deploy Sysmon with file creation and image loading rules for ProgramData paths.
- Enable COM marshaling mitigations via COMGLB_UNMARSHALING_POLICY_STRONG where supported.
MITRE ATT&CK Mapping
Execution
Persistence
Privilege Escalation
Stealth
Plain-Language Summary
A Windows bug lets any local user gain administrator privileges by exploiting a broken COM object registration. The registration points to a DLL file that should exist but does not, in a folder any user can write to. An attacker places their own malicious DLL at that location, then tricks a high-privilege Windows service into loading it. Microsoft has released a patch. Affected systems should apply it immediately and check for unexpected DLL files in the ProgramData directory.
Additional IOCs
- File Paths:
C:\ProgramData\CrossDevice\- User-writable directory where attacker creates the planted DLL.
- Command Lines:
- Purpose: Start the Shell Create Object Handler scheduled task as a normal user | Tools:
schtasks.exe,PowerShell| Stage: Execution - Purpose: Create global named event to prevent task from exiting | Tools:
PowerShell,NtObjectManager| Stage: Execution |New-NtEvent -Win32Path "Global\ShellCreateObjectTaskReadyEvent"
- Purpose: Start the Shell Create Object Handler scheduled task as a normal user | Tools:
- Other:
\Microsoft\Windows\Shell\CreateObjectTask- User-accessible scheduled task that starts the SYSTEM COM service.{75121952-E0D0-43E5-9380-1D80483ACF72}- IID of ICreateObject interface used to pass fake marshaled object to SYSTEM process.
- cveCVE-2026-50343Original 'Dark Elevator' bug with weak registry permissions on COM installer plugin.
- cveCVE-2026-66804Dangling COM object registration enables local privilege escalation via DLL planting.
- file_pathC:\ProgramData\CrossDevice\User-writable directory where attacker creates the planted DLL.
- file_path%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dllAttacker-planted DLL at writable path referenced by dangling COM registration.
- mutexGlobal\ShellCreateObjectTaskReadyEventNamed event created by attacker to keep Shell Create Object Handler service alive.
- registry_keyHKEY_CLASSES_ROOT\CLSID\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}Dangling COM registration for CrossDevice object with missing server DLL.
