TLDR Tech / InfoSec
Cross-Session Activation
Purple Team detailed Cross-Session Activation (MITRE T1021.003), a DCOM lateral movement technique where elevated attackers hijack CLSIDs configured with RunAs=Interactive User to execute code inside another logged-in user's session via CoCreateInstanceEx and SetSessionId, with PoCs from Michael Zhmailo (IHxExec, sppui), Andrew Oliveau (SessionHop), and tooling like PermissionHunter, ComDiver, and ComHijackWrite. High-priority hijackable AppIDs include Speech Runtime, sppui, Auth UI CredUI, ShellServiceHost, and ActivatableApplicationRegistrar, all reachable once Remote Registry is started and a DLL is dropped via admin share. Defenders should hunt anomalous HelpPane.exe and slui.exe child processes (Event ID 4688), enable Audit Registry on the listed CLSIDs to capture Event ID 4663, and verify EDR hooks on WTSEnumerateSessions/WinStation* APIs used during session discovery.
Read the full story