Transparent COM instrumentation for malware analysis
Summary: Cisco Talos released DispatchLogger, an open-source DLL that hooks COM instantiation APIs such as CoCreateInstance, CoGetClassObject, CoGetObject and MkParseDisplayName, then returns transparent proxies that log method names, parameters and return values while recursively wrapping every IDispatch object returned. The tool was built after testing showed hooking CoCreateInstance alone missed most VBScript CreateObject calls, because VBScript requests IUnknown first and queries for IDispatch afterward.
Why it matters: Script-based malware in VBScript, JScript and PowerShell relies on COM automation, and Talos estimates coverage of its late-binding approach at 100% for Windows Script Host, PowerShell and AutoIT versus 10% for C++ malware that rarely uses it - so the blind spot this closes sits directly in the tooling most commodity loaders already use.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026