uac_bypass_auto_elevated_cmstplua_com_interface.sql

-- The query identifies elevated processes executed using UAC bypass through an auto-approval enabled COM interface (CMSTPLUA)
-- This activity was observed by the team in a recent InfoStealer campaign targeting Mexico (August 2023)
-- The query joins the relevant DllHost.exe hosting the COM interface with its RPC client process that initiated the UAC bypass
-- The query joins the relevant DllHost.exe with its child processes, which are the target payloads to be run elevated while bypassing UAC
-- The query can be adjusted to the preferred EDR solution
WITH AUTO_ELEVATED_CMSTPLUA_INTERFACE AS (
    SELECT 
        EVENT_TIME,
        AID,
        EVENT_NAME,
        IMAGE_FILE_NAME,
        COMMAND_LINE,
        TARGET_PROCESS_ID,
        RPC_CLIENT_PROCESS_ID,
        INTEGRITY_LEVEL_DESCRIPTION
    FROM EDR_RAW_DATA
    WHERE 
        -- DllHost.exe process creation with the relevant CLSID in the /Processid argument
        COMMAND_LINE ILIKE '%\\WINDOWS\\system32\\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
        AND EVENT_TIME > CURRENT_TIMESTAMP - INTERVAL '30d'
        AND EVENT_NAME LIKE 'Process%' -- Modify with the relevant EDR event name
),
-- All process creation events
PROCESS_CREATIONS AS (
    SELECT 
        EVENT_TIME,
        AID,
        EVENT_NAME,
        IMAGE_FILE_NAME,
        COMMAND_LINE,
        TARGET_PROCESS_HASH,
        TARGET_PROCESS_ID,
        PARENT_PROCESS_ID,
        INTEGRITY_LEVEL_DESCRIPTION
    FROM EDR_RAW_DATA
    WHERE 
        EVENT_TIME > CURRENT_TIMESTAMP - INTERVAL '30d'
        AND EVENT_NAME LIKE 'Process%' -- Modify with the relevant EDR event name
)
SELECT DISTINCT 
    TARGET_ELEVATED_PROC.EVENT_TIME AS ELEVATED_PROCESS_CREATION_TIME, 
    TARGET_ELEVATED_PROC.AID AS AGENT_ID, 
    TARGET_ELEVATED_PROC.EVENT_NAME AS EVENT_NAME, 
    TARGET_ELEVATED_PROC.COMMAND_LINE AS ELEVATED_PROCESS_COMMAND_LINE, 
    TARGET_ELEVATED_PROC.TARGET_PROCESS_HASH AS ELEVATED_PROCESS_HASH, 
    TARGET_ELEVATED_PROC.INTEGRITY_LEVEL_DESCRIPTION AS TARGET_ELEVATED_PROC_INTEGRITY_LEVEL, 
    INITIATING_PROC.IMAGE_FILE_NAME AS UAC_BYPASS_INITIATING_PROCESS_NAME, 
    INITIATING_PROC.COMMAND_LINE AS UAC_BYPASS_INITIATING_COMMAND_LINE, 
    INITIATING_PROC.TARGET_PROCESS_HASH AS INITIATING_PROCESS_HASH
FROM 
    AUTO_ELEVATED_CMSTPLUA_INTERFACE
LEFT JOIN 
    PROCESS_CREATIONS INITIATING_PROC
ON 
    -- Process responsible for the UAC bypass
    INITIATING_PROC.AID = AUTO_ELEVATED_CMSTPLUA_INTERFACE.AID
    AND RPC_CLIENT_PROCESS_ID = INITIATING_PROC.TARGET_PROCESS_ID
    AND AUTO_ELEVATED_CMSTPLUA_INTERFACE.EVENT_TIME BETWEEN INITIATING_PROC.EVENT_TIME AND DATEADD(MINUTE, 10, INITIATING_PROC.EVENT_TIME)
INNER JOIN 
    PROCESS_CREATIONS TARGET_ELEVATED_PROC
ON 
    -- Target elevated process
    TARGET_ELEVATED_PROC.AID = AUTO_ELEVATED_CMSTPLUA_INTERFACE.AID
    AND AUTO_ELEVATED_CMSTPLUA_INTERFACE.TARGET_PROCESS_ID = TARGET_ELEVATED_PROC.PARENT_PROCESS_ID
    AND TARGET_ELEVATED_PROC.EVENT_TIME BETWEEN AUTO_ELEVATED_CMSTPLUA_INTERFACE.EVENT_TIME AND DATEADD(MINUTE, 10, AUTO_ELEVATED_CMSTPLUA_INTERFACE.EVENT_TIME)
    AND TARGET_ELEVATED_PROC.INTEGRITY_LEVEL_DESCRIPTION = 'high_integrity'
ORDER BY 
    TARGET_ELEVATED_PROC.EVENT_TIME ASC;