attack.t1548.002

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

HackTool - WinPwn Execution - ScriptBlock

Oct 1, 2024 · attack.credential-access attack.defense-evasion attack.discovery attack.execution attack.privilege-escalation attack.t1046 attack.t1082 attack.t1106 attack.t1518 attack.t1548.002 attack.t1552.001 attack.t1555 attack.t1555.003 ·

Share on:

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

PowerShell Web Access Feature Enabled Via DISM

Sep 3, 2024 · attack.persistence attack.t1548.002 ·

Share on:

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Always Install Elevated MSI Spawned Cmd And Powershell

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Bypass UAC Using DelegateExecute

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Bypasses User Account Control using a fileless method

Bypass UAC Using SilentCleanup Task

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

Bypass UAC via CMSTP

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 attack.t1218.003 ·

Share on:

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Bypass UAC via Fodhelper.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Bypass UAC via WSReset.exe

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

Explorer NOUACCHECK Flag

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·

Share on:

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Function Call From Undocumented COM Interface EditionUpgradeManager

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

HackTool - Empire PowerShell UAC Bypass

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects some Empire PowerShell UAC bypass methods

Potentially Suspicious Event Viewer Child Process

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Sdclt Child Processes

Aug 12, 2024 · attack.privilege-escalation attack.t1548.002 ·

Share on:

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Shell Open Registry Keys Manipulation

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1546.001 ·

Share on:

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

TrustedPath UAC Bypass Pattern

Aug 12, 2024 · attack.defense-evasion attack.t1548.002 ·

Share on:

Detects indicators of a UAC bypass method by mocking directories

UAC Bypass Abusing Winsat Path Parsing - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Abusing Winsat Path Parsing - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

UAC Bypass Using .NET Code Profiler on MMC

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)

UAC Bypass Using Consent and Comctl32 - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

UAC Bypass Using IDiagnostic Profile - File

Aug 12, 2024 · attack.execution attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

UAC Bypass Using IEInstal - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

UAC Bypass Using Iscsicpl - ImageLoad

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

UAC Bypass Using MSConfig Token Modification - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

UAC Bypass Using NTFS Reparse Point - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

UAC Bypass Using Windows Media Player - File

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UAC Bypass Using Windows Media Player - Registry

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

UAC Bypass Using WOW64 Logger DLL Hijack

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)

UAC Bypass via Event Viewer

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects UAC bypass method using Windows event viewer

UAC Bypass via ICMLuaUtil

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

UAC Bypass via Sdclt

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 car.2019-04-001 ·

Share on:

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

UAC Bypass Via Wsreset

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

UAC Bypass With Fake DLL

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.002 ·

Share on:

Attempts to load dismcore.dll after dropping it

UAC Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.

UAC Notification Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed.

UAC Secure Desktop Prompt Disabled

Aug 12, 2024 · attack.privilege-escalation attack.defense-evasion attack.t1548.002 ·

Share on:

Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.

Explorer UAC Bypass Via /NOUACCHECK Parameter

Aug 10, 2024 · attack.privilege_escalation attack.T1548.002 ·

Share on:

Detects possible attempt to circumvent the User Account Control (UAC) by executing Windows Explorer to spawn a command line interpreter process without triggering UAC prompts.

MSI Spawned Cmd and Powershell Spawned Processes

Apr 21, 2023 · attack.privilege_escalation attack.t1548.002 ·

Share on:

This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell that spawns other processes