UAC Bypass Using IEInstal - File
Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
Sigma rule (View on GitHub)
1title: UAC Bypass Using IEInstal - File
2id: bdd8157d-8e85-4397-bb82-f06cc9c71dbb
3status: test
4description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
5references:
6 - https://github.com/hfiref0x/UACME
7author: Christian Burkard (Nextron Systems)
8date: 2021/08/30
9modified: 2022/10/09
10tags:
11 - attack.defense_evasion
12 - attack.privilege_escalation
13 - attack.t1548.002
14logsource:
15 category: file_event
16 product: windows
17detection:
18 selection:
19 Image: 'C:\Program Files\Internet Explorer\IEInstal.exe'
20 TargetFilename|startswith: 'C:\Users\'
21 TargetFilename|contains: '\AppData\Local\Temp\'
22 TargetFilename|endswith: 'consent.exe'
23 condition: selection
24falsepositives:
25 - Unknown
26level: high
References
Related rules
- Shell Open Registry Keys Manipulation
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI