Detecting UAC bypass - elevated COM interface

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

This query identifies processes spawned with high integrity from dllhost.exe with a command line that contains one of three specific CLSID GUIDs.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1490` Inhibit System Recovery

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

id: 2d5efc71-2e91-4ca2-8506-857eecb453ec
name: Detecting UAC bypass - elevated COM interface
description: |
  This query identifies processes spawned with high integrity from dllhost.exe with a command line that contains one of three specific CLSID GUIDs.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1490
query: |
  DeviceProcessEvents
  | where InitiatingProcessFileName =~ "dllhost.exe"
  | where ProcessIntegrityLevel == "High"
  | where InitiatingProcessCommandLine has_any ("E9495B87-D950-4AB5-87A5-FF6D70BF3E90", "3E5FC7F9-9A51-4367-9063-A120244FBEC7", "D2E7041B-2927-42fb-8E9F-7CE93B6DC937")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Account
    fieldMappings:
      - identifier: Sid
        columnName: AccountSid
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

DeviceProcessEvents

Stage 2: `where`

| where InitiatingProcessFileName =~ "dllhost.exe"

Stage 3: `where`

| where ProcessIntegrityLevel == "High"

Stage 4: `where`

| where InitiatingProcessCommandLine has_any ("E9495B87-D950-4AB5-87A5-FF6D70BF3E90", "3E5FC7F9-9A51-4367-9063-A120244FBEC7", "D2E7041B-2927-42fb-8E9F-7CE93B6DC937")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`InitiatingProcessCommandLine`	match	`3E5FC7F9-9A51-4367-9063-A120244FBEC7` transforms: `term` corpus 2 (elastic 1, kusto 1) `D2E7041B-2927-42fb-8E9F-7CE93B6DC937` transforms: `term` corpus 2 (elastic 1, kusto 1) `E9495B87-D950-4AB5-87A5-FF6D70BF3E90` transforms: `term`	`field:"ParentCommandLine" kind:match`
`InitiatingProcessFileName`	eq	`dllhost.exe` corpus 9 (elastic 6, kusto 2, splunk 1)	`field:"parent_process_name" kind:eq value:"dllhost.exe"`
`ProcessIntegrityLevel`	eq	`High` corpus 21 (sigma 17, kusto 3, splunk 1)	`field:"IntegrityLevel" kind:eq value:"High"`

Detecting UAC bypass - elevated COM interface

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Indicators

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`