Query: rule covering Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UA
Matching passage: Sigma rule: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UA. Logsource: windows / process_creation. Rule: title: CMSTP UAC Bypass via COM Object Access id: 4b60e6f2-bf39-47b4-b4ea-398e33cfe253 status: stable description: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65) references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ - https://twitter.com/hFireF0X/status/897640081053364225 - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf - https://github.com/hfiref0x/UACME author: Nik Seetharaman, Christian Burkard (Nextron Systems) date: 2019-07-31 modified: 2024-12-01 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1548.002 - attack.t1218.003 - attack.g0069 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DllHost.exe ParentCommandLine|contains: - ' /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}' - ' /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}' - ' /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}' - ' /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}' - ' /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}' IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Legitimate CMSTP use (unlikely in modern enterprise environments) level: high
Near-miss passage: Sigma rule: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.. Logsource: windows / file_event. Rule: title: Startup Folder File Write id: 2aa0a6b4-a865-495b-ab51-c28249537b75 related: - id: 28208707-fe31-437f-9a7f-4b1108b94d2e type: similar status: test description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/12 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-12-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp filter_main_update: - Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\uus\ARM64\wuaucltcore.exe - TargetFilename|startswith: - C:\$WINDOWS.~BT\NewOS\ - C:\$WinREAgent\Scratch\Mount\ filter_optional_onenote: Image|endswith: \ONENOTE.EXE TargetFilename|endswith: \Send to OneNote.lnk condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate level: medium