{"id":"4b60e6f2-bf39-47b4-b4ea-398e33cfe253","title":"CMSTP UAC Bypass via COM Object Access","description":"Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)","author":"Nik Seetharaman, Christian Burkard (Nextron Systems)","status":"stable","level":"high","date":"2019-07-31","modified":"2024-12-01","tags":["attack.execution","attack.privilege-escalation","attack.stealth","attack.t1548.002","attack.t1218.003","attack.g0069","car.2019-04-001"],"technique_ids":["T1218.003","T1548.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate CMSTP use (unlikely in modern enterprise environments)"],"references":["https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/","https://twitter.com/hFireF0X/status/897640081053364225","https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf","https://github.com/hfiref0x/UACME"],"source_path":"rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml","source_sha256":"4dbb1a6e0e5615218630fc10b1df7b2fc8fb875479fbf69dafc0dbf9ca4014d5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: CMSTP UAC Bypass via COM Object Access\nid: 4b60e6f2-bf39-47b4-b4ea-398e33cfe253\nstatus: stable\ndescription: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)\nreferences:\n    - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/\n    - https://twitter.com/hFireF0X/status/897640081053364225\n    - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf\n    - https://github.com/hfiref0x/UACME\nauthor: Nik Seetharaman, Christian Burkard (Nextron Systems)\ndate: 2019-07-31\nmodified: 2024-12-01\ntags:\n    - attack.execution\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1548.002\n    - attack.t1218.003\n    - attack.g0069\n    - car.2019-04-001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\DllHost.exe'\n        ParentCommandLine|contains:\n            - ' /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}' # cmstplua.dll\n            - ' /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}' # CMLUAUTIL\n            - ' /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}' # EditionUpgradeManagerObj.dll\n            - ' /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}' # colorui.dll\n            - ' /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}' # wscui.cpl\n        IntegrityLevel:\n            - 'High'\n            - 'System'\n            - 'S-1-16-16384' # System\n            - 'S-1-16-12288' # High\n    condition: selection\nfalsepositives:\n    - Legitimate CMSTP use (unlikely in modern enterprise environments)\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.003","id":"T1218.003","name":"CMSTP","page":"techniques/enterprise/T1218.003/"},{"key":"enterprise/T1548.002","id":"T1548.002","name":"Bypass User Account Control","page":"techniques/enterprise/T1548.002/"}],"data_path":"data/detection-rules/4b60e6f2-bf39-47b4-b4ea-398e33cfe253.json","kind":"sigma"}