COM, or Component Object Model, is a Microsoft framework for inter-application communication and object activation. It lets one program create, call, or control components exposed by another program or system service, often through automation interfaces. In Windows environments, COM underpins many trusted workflows such as document handling, shell integration, and app-to-app launch chains.
In cyber security, COM matters because it is a common abuse point and a common dependency. Attackers may hijack COM registrations, abuse COM objects for persistence, or use COM-based automation to start trusted programs and blend into normal activity. Defenders should watch for unusual registry changes, suspicious object activation, and unexpected parent-child process chains. Good patching, application allowlisting, and testing of real business workflows help reduce breakage and make COM abuse harder to hide.