COM Auto-Elevation via dllhost.exe Bypassing UAC

Duo Tech@duotech

•updated Jul 21, 2026•0•0•2

Detects instances of dllhost.exe running with elevated integrity (High or System) that were not spawned by the standard DCOM Server Process Launcher (svchost.exe). This behavior is characteristic of COM object hijacking or auto-elevation techniques used to bypass UAC.