{"id":"fb3722e4-1a06-46b6-b772-253e2e7db933","title":"Function Call From Undocumented COM Interface EditionUpgradeManager","description":"Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.","author":"oscd.community, Dmitry Uchakin","status":"test","level":"medium","date":"2020-10-07","modified":"2023-11-30","tags":["attack.privilege-escalation","attack.t1548.002"],"technique_ids":["T1548.002"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/","https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611"],"source_path":"rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml","source_sha256":"c172a256bf7c539a5b146cc2e9179c51a9c750b0606b7639fce47fe76d0ba6c4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Function Call From Undocumented COM Interface EditionUpgradeManager\nid: fb3722e4-1a06-46b6-b772-253e2e7db933\nstatus: test\ndescription: Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.\nreferences:\n    - https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/\n    - https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611\nauthor: oscd.community, Dmitry Uchakin\ndate: 2020-10-07\nmodified: 2023-11-30\ntags:\n    - attack.privilege-escalation\n    - attack.t1548.002\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        CallTrace|contains: 'editionupgrademanagerobj.dll'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1548.002","id":"T1548.002","name":"Bypass User Account Control","page":"techniques/enterprise/T1548.002/"}],"data_path":"data/detection-rules/fb3722e4-1a06-46b6-b772-253e2e7db933.json","kind":"sigma"}