Elastic Defend high stable eql

UAC Bypass via Sdclt

Identifies attempts to bypass User Account Control (UAC) via sdclt.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

process where event.action == "start" and
 process.parent.name : "sdclt.exe" and process.parent.command_line : "*/kickoffelev*" and
 process.Ext.token.integrity_level_name == "high" and
 not process.executable :
           ("?:\\Windows\\SysWOW64\\sdclt.exe",
            "?:\\Windows\\System32\\sdclt.exe",
            "?:\\Windows\\SysWOW64\\control.exe",
            "?:\\Windows\\System32\\control.exe",
            "?:\\Windows\\System32\\WerFault.exe",
            "?:\\Windows\\SysWOW64\\WerFault.exe",
            "?:\\Windows\\System32\\wermgr.exe",
            "?:\\Windows\\SysWOW64\\wermgr.exe")

Field Validations

Loading…

Comments (0)

Loading comments...