Elastic Defend high stable eql

Potential UAC Bypass via IElevatedFactoryServer

Identifies attempt to elevate privileges to bypass User Account Control via an elevated function ServerCreateElevatedObject exposed by the Virtual Factory for MaintenanceUI COM object. Attackers may attempt to instantiate other privileged COM objects by proxy such as the ITaskService to execute with elevated permissions.

View Source

Detection Logic

sequence with maxspan=5m
 [process where event.action == "start" and
  process.name : "dllhost.exe" and process.args : "/Processid:{A6BFEA43-501F-456F-A845-983D3AD7B8F0}"] by process.entity_id
 [file where file.path : "?:\\Windows\\System32\\Tasks\\*"] by Effective_process.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...