UAC Bypass via COM Elevation Moniker CMSTPLUA CLSID

Duo Tech@duotech

•updated Jul 20, 2026•1•0•4

Detects attempts to bypass User Account Control (UAC) by invoking the CMSTPLUA COM interface (CLSID: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). This technique allows an attacker to execute processes with elevated privileges by leveraging the auto-elevation property of this COM object, often using the 'Elevation:Administrator!new' moniker.