UAC Bypass Attempt via Windows Directory Masquerading

  1[metadata]
  2creation_date = "2020/10/26"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory.
 11Attackers may bypass UAC to stealthily execute code with elevated permissions.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "UAC Bypass Attempt via Windows Directory Masquerading"
 28references = ["https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e"]
 29risk_score = 73
 30rule_id = "290aca65-e94d-403b-ba0f-62f320e63f51"
 31severity = "high"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Privilege Escalation",
 37    "Resources: Investigation Guide",
 38    "Data Source: Elastic Endgame",
 39    "Data Source: Elastic Defend",
 40    "Data Source: Windows Security Event Logs",
 41    "Data Source: Microsoft Defender XDR",
 42    "Data Source: Sysmon",
 43    "Data Source: SentinelOne",
 44    "Data Source: Crowdstrike",
 45    "Noise: Medium",
 46    "Performance: Normal",
 47    "Profile: Recommended",
 48    "Threat: Masquerading",
 49    "Rule Type: Event Correlation (EQL)",
 50    "Platform: Windows",
 51]
 52timestamp_override = "event.ingested"
 53type = "eql"
 54
 55query = '''
 56process where host.os.type == "windows" and event.type == "start" and
 57  process.args : ("C:\\Windows \\system32\\*.exe", "C:\\Windows \\SysWOW64\\*.exe")
 58'''
 59
 60note = """## Triage and analysis
 61
 62### Investigating UAC Bypass Attempt via Windows Directory Masquerading
 63
 64#### Possible investigation steps
 65
 66- Does the alert-local path prove execution from a mock trusted Windows directory?
 67  - Why: This technique abuses a trailing-space "C:\\Windows " tree that AppInfo checks can normalize while the fake path still executes.
 68  - Focus: `process.executable` and `process.command_line`, especially "C:\\Windows \\System32\\" or "C:\\Windows \\SysWOW64\\" instead of the canonical Windows path.
 69  - Implication: escalate when executable or argument paths contain the trailing-space trusted-directory clone; lower suspicion only when `process.executable` and `process.command_line` resolve to the canonical Windows path and later evidence does not contradict that.
 70
 71- Is the binary a copied auto-elevating Windows executable?
 72  - Focus: `process.name`, `process.pe.original_file_name`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.hash.sha256`.
 73  - Implication: escalate when a signed Microsoft auto-elevating binary runs from the fake tree, name or PE metadata imitates one, or the hash is unfamiliar; if not auto-elevating, keep suspicious as path masquerading or staging until lineage and artifacts explain it.
 74
 75- Do the parent, user, and token context fit a UAC-bypass transition?
 76  - Focus: `process.parent.executable`, `process.parent.command_line`, `user.id`, `process.Ext.token.integrity_level_name`, and `process.Ext.token.elevation_level`.
 77  - Implication: escalate when a browser, document process, script host, installer, or remote-admin parent launches the copied binary with high or full integrity; lower suspicion when parent, user, token state, and host cohort align with confirmed compatibility or security testing.
 78
 79- Did file events show the fake tree being staged before or by the alerting process?
 80  - Focus: same-`host.id` file events where `file.path` is under "C:\\Windows \\", plus alert-process file events scoped by `process.entity_id` when present. $investigate_2
 81  - Hint: File telemetry is conditional; missing file events leave staging unresolved, not benign. Use `file.Ext.original.path`, `file.origin_url`, and `file.Ext.windows.zone_identifier` only when the fake-tree writer is unclear.
 82  - Implication: escalate when any process creates "C:\\Windows \\", copies the auto-elevating executable, or drops a same-directory DLL; lower suspicion only when fake-tree artifacts are bounded to controlled lab testing with no contradictory DLL or child-process evidence.
 83
 84- Did the copied binary load a sidecar DLL from the fake tree?
 85  - Focus: library events scoped by `host.id` plus `process.entity_id` when present; review `dll.path`, `dll.hash.sha256`, and `dll.code_signature.subject_name`. $investigate_3
 86  - Hint: Library telemetry is conditional; missing library events leave DLL payload execution unresolved, not benign.
 87  - Implication: escalate when the copied binary loads a same-directory DLL from the fake tree, especially unsigned, unfamiliar, or mismatched; if no DLL evidence appears, continue to child-process review before treating execution as unresolved.
 88
 89- Did the copied binary spawn elevated follow-on code?
 90  - Focus: same-`host.id` child processes where `process.parent.entity_id` matches `process.entity_id`; review child `process.command_line` and `process.Ext.token.integrity_level_name`. $investigate_4
 91  - Implication: escalate when the copied binary spawns high-integrity shells, scripts, payloads, or unexpected admin tools; if no child appears, treat execution as unresolved unless path, binary, parent, file, and DLL evidence all support controlled lab testing.
 92
 93- If local evidence is suspicious or incomplete, is the same fake path or host showing related activity?
 94  - Focus: related alerts for the same `process.executable` fake path, especially UAC-bypass, masquerading, or payload-staging detections; check same-host alert history for privilege-escalation, defense-evasion, or suspicious file-staging context.
 95    - $investigate_0
 96    - $investigate_1
 97  - Implication: escalate scope when the same fake path appears across hosts or the same host has surrounding staging, privilege-escalation, or defense-evasion alerts; keep scope local only when local evidence also supports controlled lab testing.
 98
 99- What disposition do the fake path, binary identity, lineage, artifacts, execution, and scope support?
100  - Escalate when path, binary identity, lineage, artifacts, execution, or scope show fake-tree UAC bypass; close only when all categories align with controlled lab testing and no contradictions remain; preserve artifacts and escalate when mixed or incomplete.
101
102### False positive analysis
103
104- This behavior is an operational anti-pattern outside explicit testing. Authorized compatibility or security research can trigger it only when a team deliberately constructs a trailing-space Windows tree in a controlled lab. Confirm exact `process.executable`, stable `process.hash.sha256`, Microsoft signer and original file name, `process.parent.executable`, `user.id`, `host.id`, and sidecar-DLL behavior against the same test. If test plans exist, require alignment; otherwise rely on prior alerts for the same path, hash, parent workflow, and lab cohort without unexpected elevated children.
105- Do not treat a signed Microsoft binary or lab host as sufficient. Same-directory DLL load, elevated shell, suspicious parent, internet-provenance file event, or recurrence outside the expected cohort keeps the alert suspicious until the exact test scope explains it.
106- Before an exception, validate recurrence of the minimum workflow pattern: exact `process.executable`, stable `process.hash.sha256`, `process.parent.executable`, expected sidecar-DLL behavior, and bounded `host.id` or `user.id` cohort. Avoid exceptions on "C:\\Windows " alone, binary name alone, or `host.id` alone.
107
108### Response and remediation
109
110- If confirmed benign, reverse temporary containment and record the exact fake-tree path, copied binary hash, parent workflow, user/host cohort, and sidecar-DLL behavior that proved the recognized workflow. Create an exception only after that same pattern recurs consistently for this rule.
111- If suspicious but unconfirmed, preserve a case export for the alert process, parent chain, token context, fake-tree directory, copied binary, sidecar DLLs and hashes, and any elevated child details before containment. Apply reversible containment next, such as restricting execution from the fake tree or isolating the affected host if sidecar loading, elevated children, or broader post-exploitation evidence is active.
112- If confirmed malicious, collect the copied auto-elevating binary and sidecar DLLs, preserve process, file, and library telemetry, then isolate the host after weighing business criticality. Scope other hosts for the same fake path, copied binary hash, and DLL pattern before killing processes, deleting the fake "system32" tree, and remediating the launcher or access path that staged it.
113- Post-incident hardening: remove the fake trailing-space directory tree, restrict creation or execution of copied Windows binaries from user-writable or fake trusted paths, retain file/library/process telemetry for same-directory DLL hijacking, and record the recovered auto-elevating-binary and DLL pair for future triage.
114"""
115
116setup = """## Setup
117
118This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
119
120Setup instructions: https://ela.st/install-elastic-defend
121
122### Additional data sources
123
124This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
125
126- [CrowdStrike](https://ela.st/crowdstrike-integration)
127- [Microsoft Defender XDR](https://ela.st/m365-defender)
128- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
129- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
130- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
131"""
132
133[rule.investigation_fields]
134field_names = [
135    "@timestamp",
136    "host.id",
137    "user.id",
138    "process.entity_id",
139    "process.executable",
140    "process.command_line",
141    "process.working_directory",
142    "process.pe.original_file_name",
143    "process.code_signature.subject_name",
144    "process.code_signature.trusted",
145    "process.hash.sha256",
146    "process.parent.executable",
147    "process.parent.command_line",
148    "process.Ext.token.elevation_level",
149    "process.Ext.token.integrity_level_name",
150]
151
152[transform]
153
154[[transform.investigate]]
155label = "Alerts associated with the same fake executable path"
156description = ""
157providers = [
158  [
159    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
160    { excluded = false, field = "process.executable", queryType = "phrase", value = "{{process.executable}}", valueType = "string" }
161  ]
162]
163relativeFrom = "now-48h/h"
164relativeTo = "now"
165
166[[transform.investigate]]
167label = "Alerts associated with the host"
168description = ""
169providers = [
170  [
171    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
172    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
173  ]
174]
175relativeFrom = "now-48h/h"
176relativeTo = "now"
177
178[[transform.investigate]]
179label = "File events for the suspicious process"
180description = ""
181providers = [
182  [
183    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
184    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
185    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
186  ]
187]
188relativeFrom = "now-1h"
189relativeTo = "now"
190
191[[transform.investigate]]
192label = "Library events for the suspicious process"
193description = ""
194providers = [
195  [
196    { excluded = false, field = "event.category", queryType = "phrase", value = "library", valueType = "string" },
197    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
198    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
199  ]
200]
201relativeFrom = "now-1h"
202relativeTo = "now"
203
204[[transform.investigate]]
205label = "Child processes launched by the copied binary"
206description = ""
207providers = [
208  [
209    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
210    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
211    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
212  ]
213]
214relativeFrom = "now-1h"
215relativeTo = "now"
216
217[[rule.threat]]
218framework = "MITRE ATT&CK"
219
220[[rule.threat.technique]]
221id = "T1548"
222name = "Abuse Elevation Control Mechanism"
223reference = "https://attack.mitre.org/techniques/T1548/"
224
225[[rule.threat.technique.subtechnique]]
226id = "T1548.002"
227name = "Bypass User Account Control"
228reference = "https://attack.mitre.org/techniques/T1548/002/"
229
230[rule.threat.tactic]
231id = "TA0004"
232name = "Privilege Escalation"
233reference = "https://attack.mitre.org/tactics/TA0004/"
234
235[[rule.threat]]
236framework = "MITRE ATT&CK"
237
238[[rule.threat.technique]]
239id = "T1036"
240name = "Masquerading"
241reference = "https://attack.mitre.org/techniques/T1036/"
242
243[[rule.threat.technique.subtechnique]]
244id = "T1036.005"
245name = "Match Legitimate Resource Name or Location"
246reference = "https://attack.mitre.org/techniques/T1036/005/"
247
248[[rule.threat.technique]]
249id = "T1548"
250name = "Abuse Elevation Control Mechanism"
251reference = "https://attack.mitre.org/techniques/T1548/"
252
253[[rule.threat.technique.subtechnique]]
254id = "T1548.002"
255name = "Bypass User Account Control"
256reference = "https://attack.mitre.org/techniques/T1548/002/"
257
258[rule.threat.tactic]
259id = "TA0005"
260name = "Defense Evasion"
261reference = "https://attack.mitre.org/tactics/TA0005/"