UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface

 1[metadata]
 2creation_date = "2020/10/28"
 3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows
13ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
14"""
15from = "now-9m"
16index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface"
20references = ["https://github.com/hfiref0x/UACME"]
21risk_score = 73
22rule_id = "b90cdde7-7e0d-4359-8bf0-2c112ce2008a"
23severity = "high"
24tags = [
25    "Domain: Endpoint",
26    "OS: Windows",
27    "Use Case: Threat Detection",
28    "Tactic: Privilege Escalation",
29    "Tactic: Defense Evasion",
30    "Tactic: Execution",
31    "Data Source: Elastic Endgame",
32    "Data Source: Elastic Defend",
33    "Data Source: Sysmon",
34    "Data Source: Microsoft Defender for Endpoint",
35    "Data Source: SentinelOne",
36]
37timestamp_override = "event.ingested"
38type = "eql"
39
40query = '''
41process where host.os.type == "windows" and event.type == "start" and process.name : "Clipup.exe" and
42  not process.executable : "C:\\Windows\\System32\\ClipUp.exe" and process.parent.name : "dllhost.exe" and
43  /* CLSID of the Elevated COM Interface IEditionUpgradeManager */
44  process.parent.args : "/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}"
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1548"
52name = "Abuse Elevation Control Mechanism"
53reference = "https://attack.mitre.org/techniques/T1548/"
54[[rule.threat.technique.subtechnique]]
55id = "T1548.002"
56name = "Bypass User Account Control"
57reference = "https://attack.mitre.org/techniques/T1548/002/"
58
59
60
61[rule.threat.tactic]
62id = "TA0004"
63name = "Privilege Escalation"
64reference = "https://attack.mitre.org/tactics/TA0004/"
65[[rule.threat]]
66framework = "MITRE ATT&CK"
67[[rule.threat.technique]]
68id = "T1548"
69name = "Abuse Elevation Control Mechanism"
70reference = "https://attack.mitre.org/techniques/T1548/"
71[[rule.threat.technique.subtechnique]]
72id = "T1548.002"
73name = "Bypass User Account Control"
74reference = "https://attack.mitre.org/techniques/T1548/002/"
75
76
77
78[rule.threat.tactic]
79id = "TA0005"
80name = "Defense Evasion"
81reference = "https://attack.mitre.org/tactics/TA0005/"
82[[rule.threat]]
83framework = "MITRE ATT&CK"
84[[rule.threat.technique]]
85id = "T1559"
86name = "Inter-Process Communication"
87reference = "https://attack.mitre.org/techniques/T1559/"
88[[rule.threat.technique.subtechnique]]
89id = "T1559.001"
90name = "Component Object Model"
91reference = "https://attack.mitre.org/techniques/T1559/001/"
92
93
94
95[rule.threat.tactic]
96id = "TA0002"
97name = "Execution"
98reference = "https://attack.mitre.org/tactics/TA0002/"