Windows LPE via COM CLSID: TabTip.exe invoked through DCOM activation (Microsoft-Windows-DistributedCOM 10001)

title: "Windows LPE via COM CLSID: TabTip.exe invoked through DCOM activation (Microsoft-Windows-DistributedCOM 10001)"
id: 49990e06-1d87-481c-a1a4-51c49a68b678
status: test
description: This rule flags DistributedCOM activation events where TabTip.exe is launched using a specific CLSID-based DCOM server reference. Such behavior is relevant because it can be used as part of local privilege escalation techniques that rely on COM/DCOM object activation. Detection relies on Windows System logs from Microsoft-Windows-DistributedCOM, specifically EventID 10001, including the binary path and CLSID/parameters present in the event fields.
references:
  - https://github.com/antonioCoco/JuicyPotatoNG
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-10-07
modified: 2023-04-14
tags:
  - attack.collection
  - attack.execution
  - attack.credential-access
  - attack.t1557.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-DistributedCOM
    EventID: 10001
    param1: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
    param2: 2147943140
    param3: "{054AAE20-4BEA-4347-8A35-64A533254A9D}"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bc2e25ed-b92b-4daa-b074-b502bdd1982b
    type: derived