UAC Bypass Tools Using ComputerDefaults
Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)
Sigma rule (View on GitHub)
1title: UAC Bypass Tools Using ComputerDefaults
2id: 3c05e90d-7eba-4324-9972-5d7f711a60a8
3status: test
4description: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)
5references:
6 - https://github.com/hfiref0x/UACME
7author: Christian Burkard (Nextron Systems)
8date: 2021/08/31
9modified: 2022/10/09
10tags:
11 - attack.defense_evasion
12 - attack.privilege_escalation
13 - attack.t1548.002
14logsource:
15 category: process_creation
16 product: windows
17detection:
18 selection:
19 IntegrityLevel:
20 - 'High'
21 - 'System'
22 Image: 'C:\Windows\System32\ComputerDefaults.exe'
23 filter:
24 ParentImage|contains:
25 - ':\Windows\System32'
26 - ':\Program Files'
27 condition: selection and not filter
28falsepositives:
29 - Unknown
30level: high
References
Related rules
- Shell Open Registry Keys Manipulation
- UAC Bypass Abusing Winsat Path Parsing - File
- UAC Bypass Abusing Winsat Path Parsing - Process
- UAC Bypass Using .NET Code Profiler on MMC
- UAC Bypass Using ChangePK and SLUI