UAC Bypass Attempt via Privileged IFileOperation COM Interface

 1[metadata]
 2creation_date = "2020/10/27"
 3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to
13stealthily execute code with elevated permissions.
14"""
15from = "now-9m"
16index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "UAC Bypass Attempt via Privileged IFileOperation COM Interface"
20references = [
21    "https://github.com/hfiref0x/UACME",
22    "https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies",
23]
24risk_score = 73
25rule_id = "5a14d01d-7ac8-4545-914c-b687c2cf66b3"
26severity = "high"
27tags = [
28    "Domain: Endpoint",
29    "OS: Windows",
30    "Use Case: Threat Detection",
31    "Tactic: Privilege Escalation",
32    "Tactic: Defense Evasion",
33    "Data Source: Elastic Endgame",
34    "Data Source: Elastic Defend",
35    "Data Source: Sysmon",
36    "Data Source: Microsoft Defender for Endpoint",
37    "Data Source: SentinelOne",
38]
39timestamp_override = "event.ingested"
40type = "eql"
41
42query = '''
43file where host.os.type == "windows" and event.type : "change" and process.name : "dllhost.exe" and
44  /* Known modules names side loaded into process running with high or system integrity level for UAC Bypass, update here for new modules */
45  file.name : ("wow64log.dll", "comctl32.dll", "DismCore.dll", "OskSupport.dll", "duser.dll", "Accessibility.ni.dll") and
46  /* has no impact on rule logic just to avoid OS install related FPs */
47  not file.path : ("C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\WinSxS\\*")
48'''
49
50
51[[rule.threat]]
52framework = "MITRE ATT&CK"
53[[rule.threat.technique]]
54id = "T1548"
55name = "Abuse Elevation Control Mechanism"
56reference = "https://attack.mitre.org/techniques/T1548/"
57[[rule.threat.technique.subtechnique]]
58id = "T1548.002"
59name = "Bypass User Account Control"
60reference = "https://attack.mitre.org/techniques/T1548/002/"
61
62
63
64[rule.threat.tactic]
65id = "TA0004"
66name = "Privilege Escalation"
67reference = "https://attack.mitre.org/tactics/TA0004/"
68[[rule.threat]]
69framework = "MITRE ATT&CK"
70[[rule.threat.technique]]
71id = "T1548"
72name = "Abuse Elevation Control Mechanism"
73reference = "https://attack.mitre.org/techniques/T1548/"
74[[rule.threat.technique.subtechnique]]
75id = "T1548.002"
76name = "Bypass User Account Control"
77reference = "https://attack.mitre.org/techniques/T1548/002/"
78
79
80[[rule.threat.technique]]
81id = "T1574"
82name = "Hijack Execution Flow"
83reference = "https://attack.mitre.org/techniques/T1574/"
84[[rule.threat.technique.subtechnique]]
85id = "T1574.002"
86name = "DLL Side-Loading"
87reference = "https://attack.mitre.org/techniques/T1574/002/"
88
89
90
91[rule.threat.tactic]
92id = "TA0005"
93name = "Defense Evasion"
94reference = "https://attack.mitre.org/tactics/TA0005/"