What defense strategies does the article recommend against COM object hijacking?
Defense focuses on monitoring registry modifications under `HKCU\Software\Classes\CLSID\` and specific keys like `{42aedc87-2188-41fd-b9a3-0c966feabec1}` and `{fbeb8a05-beee-4442-804e-409d6c4515e9}`. The article recommends using application whitelisting rules to block unauthorized DLLs and investigating write operations to these registry locations. Since COM hijacking can bypass Autoruns' startup item detection, these proactive measures are essential. For a broader view, see Use COM Object hijacking to maintain persistence——Hijack CAccPropServicesClass and MMDeviceEnumerator.
defenseregistry monitoringapplication whitelistingAutoruns bypassCOM hijackingpersistence