Function Call From Undocumented COM Interface EditionUpgradeManager

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects function calls from the EditionUpgradeManager COM interface, which is not typically used by standard executables. This activity can be indicative of a User Account Control (UAC) bypass attempt.