Elastic high stable eql
UAC Bypass Attempt via Windows Directory Masquerading
Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
Detection Logic
process where host.os.type == "windows" and event.type == "start" and
process.args : ("C:\\Windows \\system32\\*.exe", "C:\\Windows \\SysWOW64\\*.exe")Field Validations
Loading…
Comments (0)
Loading comments...