COM hijacking

New-Item -Path "HKCU:\Software\Classes\CLSID\{GUID}\InprocServer32" -Value "C:\payload.dll"

Registers a CLSID in the registry pointing to your DLL: when any application instantiates that COM object, your code executes.

Use it when you want persistence that triggers with normal system activity (explorer, Office, browsers) without creating processes or services. The trick: look for CLSIDs that the system instantiates at every boot and replace the InprocServer32 DLL with yours.

If the CLSID you hijack is not instantiated, there is no execution: it is the most silent persistence and at the same time the most fragile. Do not use it if the SOC has Sysmon 13 rules on Software\Classes\CLSID, which are already common in mature environments.