Elastic Defend high stable eql

UAC Bypass via Windows Activation Execution Hijack

Identifies attempts to bypass User Account Control (UAC) via Windows activation changepk.exe execution hijack. Attackers bypass UAC to stealthily execute code with elevated permissions.

View Source

Detection Logic

sequence with maxspan=60s
 [registry where registry.hive == "HKEY_USERS" and
   registry.key :
          ("S-1-5-21-*Classes\\Launcher.SystemSettings\\shell\\open\\command",
           "S-1-5-21-*Classes\\exefile\\shell\\open\\command")]
 [process where event.action == "start" and
  process.parent.name : ("changepk.exe", "slui.exe") and
  process.Ext.token.integrity_level_name == "high" and
  not process.executable :
           ("?:\\Windows\\System32\\WerFault.exe",
            "?:\\Windows\\SysWOW64\\WerFault.exe",
            "?:\\Windows\\System32\\changepk.exe",
            "?:\\WINDOWS\\system32\\slui.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...