COM Elevation Moniker UAC Bypass Followed by ServiceModelReg.exe Hollowing

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects a specific privilege escalation and code execution chain attributed to the PUROSANGUE methodology. This activity involves using a COM Elevation Moniker (specifically with the 'Elevation:Administrator!new:' syntax) to bypass UAC, followed by process hollowing into ServiceModelReg.exe. The attack is initiated from unconventional parent processes such as vsdbg.exe or its associated DLL.