↳ GitHub sourceAnalytics ruleMedium

Detecting UAC bypass - elevated COM interface

Description

This query identifies processes spawned with high integrity from dllhost.exe with a command line that contains one of three specific CLSID GUIDs.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Impact T1490

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

MicrosoftThreatProtection

Data types

DeviceProcessEvents

KQL query

Original query, unchanged.

DeviceProcessEvents
| where InitiatingProcessFileName =~ "dllhost.exe"
| where ProcessIntegrityLevel == "High"
| where InitiatingProcessCommandLine has_any ("E9495B87-D950-4AB5-87A5-FF6D70BF3E90", "3E5FC7F9-9A51-4367-9063-A120244FBEC7", "D2E7041B-2927-42fb-8E9F-7CE93B6DC937")

Declared entities

HostAccountProcess

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/FalconFriday/Analytic Rules/UACBypass-1-elevated-COM.yaml ↗
Commit: 9800e51 ↗
Source identifier: 2d5efc71-2e91-4ca2-8506-857eecb453ec

Additional source files 2

Solutions/FalconFriday/Analytic Rules/UACBypass-1-elevated-COM.yamlsource ↗Solutions/FalconFriday/Data/Solution_FalconFriday.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.