How does the WLL persistence technique compare to other Office persistence methods like COM hijacking?
The WLL method is simple and reliable: it relies on Word's Startup folder, which is a standard mechanism. In contrast, COM Object hijacking to maintain persistence——Hijack Outlook exploits COM registration, which can be more stealthy but also more complex. The article notes that WLL supports multiple files and is relatively easy to detect via folder monitoring, whereas COM hijacking may evade simple file scans.
persistence comparisonCOM hijackingWLL vs COMstealth