Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)
Alerts when TabTip.exe is started via CLSID/DCOM activation in Windows DistributedCOM EventID 10001.
- Product
- windows
- Service
- system
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-07
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
C2
Exfiltration
Impact
What it detects
This rule flags Windows DistributedCOM activity where the TabTip executable is launched via a specific CLSID (DCOM server identifier) as recorded in Microsoft-Windows-DistributedCOM Event ID 10001. Such behavior matters because it can be leveraged as part of local privilege escalation techniques that trigger COM/DCSOM components for elevated execution. The detection relies on system-level DCOM event telemetry, matching the provider name, event id, executable path, and CLSID parameters.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows LPE Attempt via TabTip CLSID Using Microsoft-Windows-DistributedCOM (Event ID 10001)
id: 49990e06-1d87-481c-a1a4-51c49a68b678
status: test
description: This rule flags Windows DistributedCOM activity where the TabTip executable is launched via a specific CLSID (DCOM server identifier) as recorded in Microsoft-Windows-DistributedCOM Event ID 10001. Such behavior matters because it can be leveraged as part of local privilege escalation techniques that trigger COM/DCSOM components for elevated execution. The detection relies on system-level DCOM event telemetry, matching the provider name, event id, executable path, and CLSID parameters.
references:
- https://github.com/antonioCoco/JuicyPotatoNG
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-10-07
modified: 2023-04-14
tags:
- attack.collection
- attack.execution
- attack.credential-access
- attack.t1557.001
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Microsoft-Windows-DistributedCOM
EventID: 10001
param1: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
param2: 2147943140
param3: "{054AAE20-4BEA-4347-8A35-64A533254A9D}"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bc2e25ed-b92b-4daa-b074-b502bdd1982b
type: derived