UNCanny InstallServiceControl COM Activation for SYSTEM-Level Coercion
This rule detects the COM activation of 'Windows.Internal.InstallService.Control.InstallServiceControl' by non-SYSTEM processes, which can be abused to invoke 'CreateInstallServiceWork' for UNC-based DLL coercion. It looks for specific strings in process command lines and additional fields in device events, as well as suspicious loading of 'combase.dll' by non-system processes.
Microsoft Sentinel (KQL)
