# Detections for UAC bypass via auto-elevated COM objects (ICMLuaUtil / CMSTPLUA)
# MITRE ATT&CK: T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control
# Sigma rule collection - split into individual files if your pipeline requires one doc per file.

title: COM Surrogate Launched for an Auto-Elevating CLSID
id: 8f3b1c42-6d5e-4a71-9c08-1e2f7a4b5c31
status: experimental
description: |
  Detects dllhost.exe being launched as a DCOM surrogate for a CLSID known to be
  abused for elevation - the two ICMLuaUtil providers (CMSTPLUA, ColorDataProxy) and
  the elevated IFileOperation object. These objects are marked auto-elevate
  in Windows and are reached via the "Elevation:Administrator!new:" moniker, letting a
  medium-integrity process run arbitrary commands at high integrity with no consent prompt.
  This is the primary host-based artifact of the technique.
references:
    - https://attack.mitre.org/techniques/T1548/002/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
author: Malware Analysis Series
date: 2026-07-30
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\dllhost.exe'
    selection_clsid:
        CommandLine|contains:
            - '3E5FC7F9-9A51-4367-9063-A120244FBEC7'   # CMSTPLUA        -> ICMLuaUtil
            - 'D2E7041B-2927-42FB-8E9F-7CE93B6DC937'   # ColorDataProxy  -> ICMLuaUtil
            - '3AD05575-8857-4850-9277-11B85BDB8E09'   # IFileOperation  -> elevated file ops
    condition: all of selection_*
fields:
    - ParentImage
    - ParentCommandLine
    - IntegrityLevel
    - User
falsepositives:
    - Genuine Connection Manager profile installation driven by cmstp.exe. Baseline first;
      on most fleets this CLSID never appears in a dllhost.exe command line.
level: high

---

title: Child Process Spawned by Auto-Elevating COM Surrogate
id: 2c9d7e18-4b03-4f56-a2d1-77e5c1b9f480
status: experimental
description: |
  Detects any process created with dllhost.exe as parent where the parent command line
  references an ICMLuaUtil-bearing CLSID. ICMLuaUtil::ShellExec runs the attacker payload
  as a child of the surrogate, so this catches the payload itself rather than just the
  setup step. Highest-fidelity rule in this set - the elevated child is the point of the
  whole technique.
references:
    - https://attack.mitre.org/techniques/T1548/002/
author: Malware Analysis Series
date: 2026-07-30
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\dllhost.exe'
        ParentCommandLine|contains:
            - '3E5FC7F9-9A51-4367-9063-A120244FBEC7'
            - 'D2E7041B-2927-42FB-8E9F-7CE93B6DC937'
    condition: selection
fields:
    - Image
    - CommandLine
    - IntegrityLevel
    - User
falsepositives:
    - Very few. Investigate every hit.
level: critical

---

title: Suspicious Interpreter or LOLBin Spawned by COM Surrogate
id: 5a1e8b60-3c72-4d94-8f11-9b6c204ad7e2
status: experimental
description: |
  CLSID-agnostic backstop for the same behaviour. Catches elevated-COM abuse through
  auto-elevate objects not on the known-CLSID list, including any new interface an
  attacker pivots to, by looking for shells and script hosts descending from dllhost.exe.
references:
    - https://attack.mitre.org/techniques/T1548/002/
author: Malware Analysis Series
date: 2026-07-30
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\dllhost.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\msiexec.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
    - IntegrityLevel
falsepositives:
    - Some shell extensions and installers legitimately spawn helpers from a COM surrogate.
      Tune by IntegrityLevel (alert on High/System) and by known-good child command lines.
level: high

---

title: Elevation Moniker String in Script or Command Line
id: 91b4c7d3-2e05-4a68-b3f7-6c8d1e59a204
status: experimental
description: |
  Detects the "Elevation:Administrator!new:" moniker passed to CoGetObject / GetObject /
  Marshal.BindToMoniker. Script-based implementations of this bypass (PowerShell, JScript,
  VBScript, C#) leave the moniker in plain text in script block logs or on the command line.
  Also flags the elevated-object naming convention used by the same family of bypasses.
references:
    - https://attack.mitre.org/techniques/T1548/002/
author: Malware Analysis Series
date: 2026-07-30
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1548.002
    - attack.execution
logsource:
    product: windows
    category: ps_script
    definition: 'Requires Script Block Logging (EID 4104) to be enabled'
detection:
    selection_moniker:
        ScriptBlockText|contains:
            - 'Elevation:Administrator!new:'
            - 'Elevation:Highest!new:'
    selection_pair:
        ScriptBlockText|contains: 'BindToMoniker'
    selection_clsid:
        ScriptBlockText|contains:
            - '3E5FC7F9-9A51-4367-9063-A120244FBEC7'
            - 'D2E7041B-2927-42FB-8E9F-7CE93B6DC937'
    condition: selection_moniker or (selection_pair and selection_clsid)
falsepositives:
    - Legitimate administrative tooling that intentionally elevates a COM object.
      Rare in user-context scripts.
level: critical

---

title: ICMLuaUtil Provider DLL Loaded by Unexpected Process
id: 7e2a5f91-8c34-4b02-9d76-3a1f8b6c0e57
status: experimental
description: |
  cmlua.dll (CMSTPLUA) and colorui.dll should only be mapped into the DCOM surrogate or
  their owning host binaries. A load into any other image suggests an in-process variant,
  a search-order hijack of the provider, or a proxy DLL planted to inherit the auto-elevate
  privilege. Lower fidelity than the process-tree rules - use as a hunt input.
references:
    - https://attack.mitre.org/techniques/T1548/002/
author: Malware Analysis Series
date: 2026-07-30
tags:
    - attack.defense-evasion
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\cmlua.dll'
            - '\colorui.dll'
    filter_expected:
        Image|endswith:
            - '\dllhost.exe'
            - '\cmstp.exe'
            - '\explorer.exe'
            - '\rundll32.exe'
            - '\svchost.exe'
    filter_path:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    condition: selection and (not filter_expected or not filter_path)
fields:
    - Image
    - ImageLoaded
    - Signed
    - SignatureStatus
falsepositives:
    - Connection Manager and colour-management UI components in legitimate use.
      Tune the filter_expected list against your own baseline.
level: medium