Elastic Defend high stable eql

UAC Bypass via Malicious MMC Snap-In Execution

Identifies attempts to bypass User Account Control (UAC) by executing a malicious Microsoft Management Console (MMC) snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

sequence with maxspan=60s
 [file where event.action != "deletion" and file.extension : "msc" and not user.name : "SYSTEM"]
 [process where event.action == "start" and
  process.name : "mmc.exe" and process.command_line : "*.msc *.msc*"]
 [process where event.action == "start" and
  process.parent.name : "mmc.exe" and process.Ext.token.integrity_level_name == "high" and
  not process.executable :
           ("?:\\Windows\\System32\\WerFault.exe",
            "?:\\Windows\\SysWOW64\\WerFault.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...