Remcos RAT COM-Based UAC Bypass via DllHost CMSTPLUA ICMLuaUtil Elevation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects Remcos RAT utilizing a COM-based UAC bypass technique. The malware leverages the CMSTPLUA CLSID ({3E5FC7F9-9A51-4367-9063-A120244FBEC7}) and the ICMLuaUtil interface to spawn an elevated process without a UAC prompt. This rule monitors for DllHost.exe acting as a COM surrogate and spawning suspicious child processes (cmd.exe, powershell.exe) or being initiated with the specific CMSTPLUA CLSID, as well as fodhelper/computerdefaults UAC bypass variants.