huntrule

Windows UAC Bypass via Elevated COM interface using ICMLuaUtil

Flags dllhost.exe parent launches tied to elevated COM /Processid GUIDs consistent with UAC bypass behavior on Windows.

FreeUnreviewedSigmahighv1
title: Windows UAC Bypass via Elevated COM interface using ICMLuaUtil
id: 87223e9c-8d8c-4b9e-b4fc-5dea62956d61
status: test
description: This rule identifies process creation where a dllhost.exe parent launches a child process with command-line parameters containing specific /Processid GUID values associated with an elevated COM interface. Such activity can be used to bypass UAC by triggering elevated behavior through COM-based execution. The detection relies on Windows process creation telemetry, specifically parent process image and parent command-line content, and excludes cases where WerFault.exe is involved.
references:
  - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml
author: Florian Roth (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-09-13
modified: 2022-09-27
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \dllhost.exe
    ParentCommandLine|contains:
      - /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
      - /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}
  filter:
    - Image|endswith: \WerFault.exe
    - OriginalFileName: WerFault.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 49f2f17b-b4c8-4172-a68b-d5bf95d05130
    type: derived

What it detects

This rule identifies process creation where a dllhost.exe parent launches a child process with command-line parameters containing specific /Processid GUID values associated with an elevated COM interface. Such activity can be used to bypass UAC by triggering elevated behavior through COM-based execution. The detection relies on Windows process creation telemetry, specifically parent process image and parent command-line content, and excludes cases where WerFault.exe is involved.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.