UAC Bypass via COM Elevation Moniker into ServiceModelReg.exe

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•1

Detects suspicious execution of ServiceModelReg.exe, either by referencing a specific known malicious file path ('purosangue.tx') or when launched by an unexpected parent process. This activity is indicative of potential COM elevation moniker abuse or process hollowing techniques often used in post-exploitation scenarios.