Elastic Defend high stable eql

UAC Bypass via Control Panel Execution Hijack

Identifies attempts to bypass User Account Control (UAC) via hijacking the default handler of the Backup and Restore control panel. Attackers bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

sequence with maxspan=1m
  [registry where
   registry.hive == "HKEY_USERS" and
   registry.key : "S-1-5-21*_Classes\\Folder\\Shell\\Open\\Command*"]
  [process where event.action == "start" and process.pe.original_file_name : "sdclt.exe"]
  [process where event.action == "start" and
   process.Ext.token.integrity_level_name == "high" and
   process.parent.name : "control.exe" and process.parent.command_line : "*Microsoft.BackupAndRestoreCenter*"]

Field Validations

Loading…

Comments (0)

Loading comments...