UAC Bypass Using Disk Cleanup
Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)
Sigma rule (View on GitHub)
1title: UAC Bypass Using Disk Cleanup
2id: b697e69c-746f-4a86-9f59-7bfff8eab881
3status: test
4description: Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)
5references:
6 - https://github.com/hfiref0x/UACME
7author: Christian Burkard (Nextron Systems)
8date: 2021/08/30
9modified: 2022/10/09
10tags:
11 - attack.defense_evasion
12 - attack.privilege_escalation
13 - attack.t1548.002
14logsource:
15 category: process_creation
16 product: windows
17detection:
18 selection:
19 CommandLine|endswith: '"\system32\cleanmgr.exe /autoclean /d C:'
20 ParentCommandLine: 'C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule'
21 IntegrityLevel:
22 - 'High'
23 - 'System'
24 condition: selection
25falsepositives:
26 - Unknown
27level: high
References
Related rules
- Shell Open Registry Keys Manipulation
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI