Remcos COM-Based UAC Bypass via Auto-Elevation Binaries and CMSTPLUA

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects potential UAC bypass or COM hijacking activities by monitoring for anomalous process spawning patterns from Windows auto-elevating binaries (e.g., eventvwr.exe, fodhelper.exe, sdclt.exe) or suspicious child processes spawned by DllHost.exe from user-writable directories.