Windows Process Access: Function Calls Involving EditionUpgradeManager COM Interface

title: "Windows Process Access: Function Calls Involving EditionUpgradeManager COM Interface"
id: fa19c6de-a2e1-4fec-80ae-1b161fb38df8
status: test
description: This rule flags process access events where the call trace contains references to editionupgrademanagerobj.dll, indicating function calls through the EditionUpgradeManager COM interface. Because this interface is not typically used by standard executables, it can be leveraged to perform elevated or unexpected actions during exploitation attempts. The detection relies on process access telemetry that captures call traces containing the specified DLL name.
references:
  - https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/
  - https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml
author: oscd.community, Dmitry Uchakin, Huntrule Team
date: 2020-10-07
modified: 2023-11-30
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    CallTrace|contains: editionupgrademanagerobj.dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: fb3722e4-1a06-46b6-b772-253e2e7db933
    type: derived