UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface

  1[metadata]
  2creation_date = "2020/10/28"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows
 11ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
 12"""
 13from = "now-9m"
 14index = [
 15    "winlogbeat-*",
 16    "logs-endpoint.events.process-*",
 17    "logs-windows.sysmon_operational-*",
 18    "endgame-*",
 19    "logs-m365_defender.event-*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface"
 25references = ["https://github.com/hfiref0x/UACME"]
 26risk_score = 73
 27rule_id = "b90cdde7-7e0d-4359-8bf0-2c112ce2008a"
 28severity = "high"
 29tags = [
 30    "Domain: Endpoint",
 31    "OS: Windows",
 32    "Use Case: Threat Detection",
 33    "Tactic: Privilege Escalation",
 34    "Data Source: Elastic Endgame",
 35    "Data Source: Elastic Defend",
 36    "Data Source: Sysmon",
 37    "Data Source: Microsoft Defender XDR",
 38    "Data Source: SentinelOne",
 39    "Resources: Investigation Guide",
 40    "Noise: Medium",
 41    "Performance: Normal",
 42    "Rule Type: Event Correlation (EQL)",
 43    "Platform: Windows",
 44]
 45timestamp_override = "event.ingested"
 46type = "eql"
 47
 48query = '''
 49process where host.os.type == "windows" and event.type == "start" and process.name : "Clipup.exe" and
 50  not process.executable : "C:\\Windows\\System32\\ClipUp.exe" and process.parent.name : "dllhost.exe" and
 51  /* CLSID of the Elevated COM Interface IEditionUpgradeManager */
 52  process.parent.args : "/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}"
 53'''
 54
 55note = """## Triage and analysis
 56
 57### Investigating UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
 58
 59#### Possible investigation steps
 60
 61- Does the alert show the IEditionUpgradeManager ClipUp bypass path?
 62  - Focus: `process.name`, `process.executable`, `process.parent.name`, `process.parent.args`, and `process.Ext.token.elevation_level`.
 63  - Hint: absent token metadata does not lower suspicion; the path and COM parent args still define the bypass path.
 64  - Implication: a "dllhost.exe" broker, IEditionUpgradeManager CLSID, "ClipUp.exe" name, and non-System32 path warrant UAC bypass investigation; high or full elevation raises priority. Concern drops only when later identity and child checks bind to exact servicing or authorized testing.
 65
 66- Is the non-system ClipUp image a genuine Microsoft servicing component or an attacker-defined payload?
 67  - Focus: `process.executable`, `process.hash.sha256`, `process.pe.original_file_name`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
 68  - Hint: absent hash, signature, or PE metadata does not lower suspicion; fall back to path, COM args, command line, and child behavior.
 69  - Implication: treat the image as attacker-controlled when unsigned, not Microsoft-signed, mismatched to "ClipUp.exe", or in a user-writable root. A Microsoft signer, matching original name, and stable hash reduce suspicion only when the same path ties to the servicing package under review.
 70
 71- Does the path or runtime metadata fit system-directory spoofing or lookalike staging?
 72  - Why: the alert already proves ClipUp ran outside genuine System32; a writable root ending in "\\system32\\clipup.exe" is the staging clue.
 73  - Focus: `process.executable`, `process.Ext.relative_file_creation_time`, `process.Ext.relative_file_name_modify_time`, and `process.command_line`.
 74  - Hint: absent relative timing fields leave the issue unresolved; use path root, command line, signer/hash, and local process history.
 75  - Implication: temp, profile, writable-share, or other non-Windows roots ending in "\\system32\\clipup.exe" indicate system-directory spoofing, especially with recent create or rename timing. Stable path age and servicing arguments reduce concern only after image identity also fits.
 76
 77- Did the elevated ClipUp instance start follow-on tooling?
 78  - Focus: child process starts where `process.parent.entity_id` matches `process.entity_id`, reviewing `process.name`, `process.executable`, `process.command_line`, and `process.Ext.token.integrity_level_name`. $investigate_0
 79  - Hint: if `process.entity_id` is absent, recover children with `host.id` + `process.pid` in a tight alert-time window; an empty child search is unresolved, not benign.
 80  - Implication: shells, script hosts, LOLBins, installers, or security-control tooling turn the alert into post-elevation execution. No visible child keeps the case scoped to the bypass launch, not closed.
 81
 82- Where else did this exact ClipUp pattern run?
 83  - Focus: matching process starts by `process.hash.sha256`, `process.executable`, `process.parent.args`, and `process.Ext.token.elevation_level`, scoped by `host.id` and `user.id`.
 84  - Hint: if the hash or elevation field is absent, pivot on the exact `process.executable` + `process.parent.args` pair and keep the time window tight. $investigate_1
 85  - Implication: after local evidence remains suspicious or unresolved, use matching path, hash, COM args, and elevation state to scope hosts or users; recurrence is supporting context, not a reason to close over contradictory local evidence.
 86
 87- Escalate when the COM-brokered non-system ClipUp launch pairs with attacker-defined identity, system-directory spoofing clues, unexpected elevation, or suspicious children. Close only when alert-local process evidence and supported child/history recovery bind to one confirmed servicing package or authorized OS-image test; require external confirmation when telemetry cannot prove that exact activity. Preserve evidence and escalate when answers remain mixed or incomplete.
 88
 89### False positive analysis
 90
 91- Windows edition upgrade, activation, or repair servicing can explain ClipUp activity only when evidence converges on one workflow: Microsoft-signed `process.hash.sha256`, expected `process.executable`, IEditionUpgradeManager `process.parent.args`, compatible `process.Ext.token.integrity_level_name` when present, and no suspicious children. If change records are unavailable, require telemetry confirmation from the same signed hash, path, parent args, `host.id`, and `user.id` pattern on the same host.
 92- Treat non-System32 ClipUp as an operational anti-pattern outside servicing. The only other benign path is an authorized OS-image or lab test where `process.executable`, `process.hash.sha256`, `process.command_line`, `process.parent.executable`, `process.parent.args`, and `user.id` all match the exact test case. Any unsigned image, writable-profile path, or elevated child tooling contradicts this explanation.
 93- Before creating an exception, require a stable benign pattern for `process.executable`, `process.hash.sha256`, `process.parent.args`, `process.Ext.token.integrity_level_name`, and relevant `host.id` or `user.id`. Avoid exceptions on `process.name`, `process.parent.name`, or the COM CLSID alone.
 94
 95### Response and remediation
 96
 97- If confirmed benign, reverse temporary containment and record the image identity, broker context, token state, `host.id`, and `user.id` that proved the servicing or deployment workflow. Create an exception only after the same full pattern repeats benignly.
 98- If suspicious but unconfirmed, preserve the alert, endpoint timeline export, process tree, non-system ClipUp path and hash, IEditionUpgradeManager parent context, token details, and recovered child-process evidence before containment.
 99- If suspicious but unconfirmed, apply reversible containment tied to the findings: block the non-system ClipUp path or hash, end the associated user session when needed, or raise monitoring on the affected `host.id`. Isolate the host only if elevated children, control tampering, or broader suspicious process history raises impact.
100- If confirmed malicious, isolate the host, terminate the rogue ClipUp instance and elevated children after recording their process identifiers, and block the confirmed path or hash. Review the same hash, path, COM parent args, and user across other hosts before deleting artifacts.
101- Eradicate only the staged ClipUp copy, launched payloads, persistence, or launcher artifacts identified during the investigation, then restore affected controls and validate that the Windows servicing path uses the genuine System32 binary.
102- Post-incident hardening: restrict system-binary lookalikes from user-writable paths with WDAC or AppLocker, retain process lineage and token telemetry for elevated COM abuse, and document any missing telemetry or uncovered variant with the preserved evidence set.
103"""
104
105setup = """## Setup
106
107This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
108
109Setup instructions: https://ela.st/install-elastic-defend
110
111### Additional data sources
112
113This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
114
115- [Microsoft Defender XDR](https://ela.st/m365-defender)
116- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
117- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
118"""
119
120[rule.investigation_fields]
121field_names = [
122    "@timestamp",
123    "host.id",
124    "user.id",
125    "process.pid",
126    "process.entity_id",
127    "process.executable",
128    "process.command_line",
129    "process.pe.original_file_name",
130    "process.code_signature.subject_name",
131    "process.code_signature.trusted",
132    "process.hash.sha256",
133    "process.parent.executable",
134    "process.parent.args",
135    "process.Ext.token.elevation_level",
136    "process.Ext.token.integrity_level_name",
137]
138
139[transform]
140
141[[transform.investigate]]
142label = "Child processes launched by the rogue ClipUp instance"
143description = ""
144providers = [
145  [
146    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
147    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
148    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
149  ],
150  [
151    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
152    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
153    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
154  ]
155]
156relativeFrom = "now-1h"
157relativeTo = "now"
158
159[[transform.investigate]]
160label = "Process events for the same ClipUp path and COM interface"
161description = ""
162providers = [
163  [
164    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
165    { excluded = false, field = "process.executable", queryType = "phrase", value = "{{process.executable}}", valueType = "string" },
166    { excluded = false, field = "process.parent.args", queryType = "phrase", value = "{{process.parent.args}}", valueType = "string" }
167  ]
168]
169relativeFrom = "now-48h/h"
170relativeTo = "now"
171
172[[rule.threat]]
173framework = "MITRE ATT&CK"
174
175[[rule.threat.technique]]
176id = "T1548"
177name = "Abuse Elevation Control Mechanism"
178reference = "https://attack.mitre.org/techniques/T1548/"
179
180[[rule.threat.technique.subtechnique]]
181id = "T1548.002"
182name = "Bypass User Account Control"
183reference = "https://attack.mitre.org/techniques/T1548/002/"
184
185[rule.threat.tactic]
186id = "TA0004"
187name = "Privilege Escalation"
188reference = "https://attack.mitre.org/tactics/TA0004/"
189
190[[rule.threat]]
191framework = "MITRE ATT&CK"
192
193[[rule.threat.technique]]
194id = "T1548"
195name = "Abuse Elevation Control Mechanism"
196reference = "https://attack.mitre.org/techniques/T1548/"
197
198[[rule.threat.technique.subtechnique]]
199id = "T1548.002"
200name = "Bypass User Account Control"
201reference = "https://attack.mitre.org/techniques/T1548/002/"
202
203[rule.threat.tactic]
204id = "TA0005"
205name = "Defense Evasion"
206reference = "https://attack.mitre.org/tactics/TA0005/"
207
208[[rule.threat]]
209framework = "MITRE ATT&CK"
210
211[[rule.threat.technique]]
212id = "T1559"
213name = "Inter-Process Communication"
214reference = "https://attack.mitre.org/techniques/T1559/"
215
216[[rule.threat.technique.subtechnique]]
217id = "T1559.001"
218name = "Component Object Model"
219reference = "https://attack.mitre.org/techniques/T1559/001/"
220
221[rule.threat.tactic]
222id = "TA0002"
223name = "Execution"
224reference = "https://attack.mitre.org/tactics/TA0002/"