Elastic Defend high stable eql

UAC Bypass Attempt via CDSSync Scheduled Task Hijack

Identifies attempts to bypass User Account Control (UAC) via CDSSync scheduled task hijack by modifying the system root environment variable leading to loading a malicious npmproxy.dll module. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

sequence with maxspan=60s
  [file where file.path : "?:\\*\\system32\\npmproxy.dll" and
   not file.path : ("?:\\Windows\\System32\\npmproxy.dll", "?:\\Windows\\SysWOW64\\npmproxy.dll")]
  [process where event.action == "start" and
   process.parent.name : "taskhostw.exe" and process.Ext.token.integrity_level_name == "high" and
   not (process.executable : ("?:\\Windows\\System32\\rdrleakdiag.exe", "C:\\Windows\\System32\\WinSAT.exe") and
        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft*")]

Field Validations

Loading…

Comments (0)

Loading comments...