Elastic Defend high stable eql

UAC Bypass via ComputerDefaults Execution Hijack

Identifies attempts to bypass User Account Control (UAC) via ComputerDefaults execution hijack. Attackers bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

sequence with maxspan=60s
 [registry where registry.hive == "HKEY_USERS" and
   registry.key : "S-1-5-21-*Classes\\ms-settings\\shell\\open\\command"]
 [process where event.action == "start" and process.parent.name : "ComputerDefaults.exe" and
  process.Ext.token.integrity_level_name == "high" and
  not process.executable :
           ("?:\\Windows\\System32\\WerFault.exe",
            "?:\\Windows\\SysWOW64\\WerFault.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...