Remcos RAT UAC Bypass via ICMLuaUtil CMSTPLUA COM Elevation
Detects Remcos RAT attempting to bypass User Account Control (UAC) by abusing the ICMLuaUtil COM interface (CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7). The rule identifies potential elevation by monitoring for processes executing under a High integrity level that originated from known Remcos installation paths or binary names, as well as registry access to the specific malicious CLSID.
Microsoft Sentinel (KQL)
