Elastic Defend high stable eql

UAC Bypass Attempt via Windows Directory Masquerading

Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

process where event.action == "start" and
 process.Ext.token.integrity_level_name == "high" and
  process.args :
         ("?:\\Windows \\System32\\*.exe",
          "?:\\Windows \\SysWOW64\\*.exe",
          "?:\\ Windows*\\System32\\*.exe",
          "?:\\ Windows*\\SysWOW64\\*.exe")

Field Validations

Loading…

Comments (0)

Loading comments...