Elastic Defend high stable eql

UAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking

Identifies attempts to bypass User Account Control (UAC) via DLL search order hijacking. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

sequence by user.id with maxspan=1m
   [library where
    dll.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\api-ms-win-core-kernel32-legacy-l1.dll" and
    process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe"] by process.entity_id
   [process where event.action == "start" and process.Ext.token.integrity_level_name == "high" and
    process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe" and
    not (process.executable : ("?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe", "?:\\Windows\\System32\\wermgr.exe") and
         process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft *")] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...