Transparent COM instrumentation for malware analysis

Cisco Talos has released DispatchLogger, an open-source tool that intercepts late-bound IDispatch interactions via transparent proxying to provide detailed visibility into script-based malware using Windows COM automation. The tool hooks APIs like CoCreateInstance and CoGetClassObject to recursively wrap objects, capturing method calls, parameters, and return values throughout execution. It is particularly useful for analyzing WMI-based attacks, living-off-the-land techniques, and persistence mechanisms without modifying the target script.