dllhost.exe

Overview

dllhost.exe, known as the COM Surrogate, is a Windows host process responsible for loading and running COM objects on behalf of other applications.

Its purpose is to isolate potentially unstable or untrusted COM components so they do not crash or compromise the parent process.

In practice, dllhost.exe acts as a generic container process. It hosts whichever COM object it has been instructed to load.

Expected Characteristics

Expected Location

Expected Parent

Varies depending on the calling application, but commonly includes:

Typical Profile

Why This Matters

COM objects are used throughout Windows and many third-party applications.

Examples include:

Because dllhost.exe executes COM components on behalf of other processes, attackers can abuse it to:

Investigation Objective

Determine whether the COM object being hosted is:

The process itself provides very little investigative value. The legitimacy of dllhost.exe depends entirely on the COM object it loads.

Normal Behaviour

Characteristics

Path

Signature

Parent Processes

Common examples include:

Children

dllhost.exe should not normally spawn additional processes.

Lifetime

Typical Activity

Expected Behavioural Characteristics

dllhost.exe commonly appears during:

The presence of dllhost.exe alone is not inherently suspicious.

Abuse Patterns

Path or Signature Mismatch

Investigate immediately if:

COM Surrogate is a common target for masquerading because many users are unfamiliar with the process.

Suspicious Parent Processes

Investigate when dllhost.exe is launched by:

Particularly when correlated with phishing activity or suspicious user actions.

Unusual COM Object Loading

Investigate DLLs loaded from:

Additional concerns include:

Unexpected Child Processes

dllhost.exe should not launch:

powershell.exe

cmd.exe

mshta.exe

wscript.exe

cscript.exe

rundll32.exe

Any child process should be considered highly suspicious.

COM Hijacking

Investigate:

COM hijacking is frequently used to execute attacker-controlled code inside trusted Windows processes.

Registry-Based Persistence

Particular attention should be paid to:

HKCR\CLSID\{GUID}

Investigate:

Anomalous Frequency

Investigate:

Repeated execution often indicates unstable components, persistence mechanisms, or malicious automation.

Detection Opportunities

DLL Path Analytics

The hosted COM object is usually more important than dllhost.exe itself.

Investigate DLLs loaded from:

COM Registration Monitoring

Monitor changes to:

HKCR\CLSID

and related COM registration paths.

Unexpected registration changes often indicate persistence attempts.

Parent Process Analysis

Investigate parent-child relationships involving:

Parent context frequently reveals how the COM object was triggered.

Child Process Monitoring

Alert on:

originating from dllhost.exe.

Legitimate COM Surrogate activity rarely results in process creation.

DLL Load Monitoring

Investigate:

DLL load telemetry frequently provides the most useful evidence during COM investigations.

Hunting Opportunities

Useful hunting pivots include:

The most valuable indicator is often the DLL being loaded rather than dllhost.exe itself.

False Positives

dllhost.exe frequently generates alerts because many legitimate Windows features depend upon COM.

Common Legitimate Scenarios

Examples include:

Enterprise Software

Many legitimate products utilise COM extensively, including:

These may legitimately generate large volumes of dllhost.exe activity.

Validation Questions

Check:

Determine whether the COM component appears consistently across known-good systems.

User Activity Correlation

Review:

Legitimate dllhost.exe activity is often directly tied to user actions.

Hardening Recommendations

Application Control

Consider:

Restrict execution of unauthorised DLLs where possible.

COM Governance

Maintain visibility into:

Unexpected changes should be investigated promptly.

Restrict User-Writable DLL Execution

Reduce opportunities for DLL execution from:

Many COM hijacking techniques depend on these locations.

Monitor COM Persistence Mechanisms

Particular focus should be given to:

These commonly provide persistence opportunities.

Maintain DLL Visibility

Ensure telemetry exists for:

Effective COM investigations often depend on DLL-level visibility.

Defensive Validation

Regularly test:

Controls should be validated against realistic COM abuse scenarios.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

COM Context

Scope and Correlation

Escalation Considerations

Escalate when:

ATT&CK References

Windows Processes

COM and Persistence

MITRE ATT&CK