Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)

Alerts when TabTip.exe is started via CLSID/DCOM activation in Windows DistributedCOM EventID 10001.

FreeReviewedSigma · High · v2
Product
windows
Service
system
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-10-07
Updated
2026-07-31

ATT&CK techniques

Cred Access → Collection
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Discovery

  9. Lateral Movement

  10. C2

  11. Exfiltration

  12. Impact

What it detects

This rule flags Windows DistributedCOM activity where the TabTip executable is launched via a specific CLSID (DCOM server identifier) as recorded in Microsoft-Windows-DistributedCOM Event ID 10001. Such behavior matters because it can be leveraged as part of local privilege escalation techniques that trigger COM/DCSOM components for elevated execution. The detection relies on system-level DCOM event telemetry, matching the provider name, event id, executable path, and CLSID parameters.

Related detections9 linkedT1557.001 — drag to rearrange
Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)
Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)
Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing
Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing
Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing
Zeek DCE/RPC efs* Operations Indicative of EFS Remote Protocol Use
Windows Process Creation: ADCSPwn Command-Line Parameters Indicating ADCS Abuse
Windows WinDivert Driver Load via Image or Known IMPHASHes
Windows Process Creation: Impacket HackTool Binary Execution via Named Image Matches
Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)
Pivot detection · T1557.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.