Abuse Elevation Control Mechanism detection rulesT1548

Detects some Empire PowerShell UAC bypass methods

windows · process_creation

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

linux

Detects indicators of a UAC bypass method by mocking directories

windows · process_creation

Detection of unusual child processes by different system processes

windows · process_creation

Bypasses User Account Control using a fileless method

windows · registry_set

Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.

windows · registry_set

Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

windows · process_creation

Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

windows · process_creation

Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

windows · process_creation

Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

windows · process_creation

Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'

windows · registry_set

Detects when a process tries to access the memory of svchost to potentially dump credentials.

windows · process_access

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

windows · process_creation

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

windows · process_creation

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · process_creation

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

windows · ps_script

Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.

windows

Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

windows · process_creation

Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

windows · process_creation

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

linux

Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

windows · process_creation

Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user's profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting.

windows · file_event

Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)

windows · registry_event

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

linux · process_creation

Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.

windows · image_load

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

windows · file_event

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

windows · process_creation

Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

windows · registry_set

Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

windows · process_creation

Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)

windows · file_event

Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

windows · process_creation

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

windows · file_event

Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

windows · process_creation

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

windows · process_creation

Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

windows · process_creation

Detects the "IDiagnosticProfileUAC" UAC bypass technique

windows · process_creation

Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

windows · file_event

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

windows · file_event

Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

windows · process_creation

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

windows · image_load

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

windows · file_event

Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

windows · process_creation

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

windows · file_event

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

windows · process_creation

Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

windows · process_creation

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

windows · file_event

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

windows · process_creation

Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

windows · registry_set

Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)

windows · process_access

Detects UAC bypass method using Windows event viewer

windows · registry_set

Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

windows · process_creation

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

windows · registry_set

Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

windows · registry_event

Attempts to load dismcore.dll after dropping it

windows · image_load

Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

windows · process_creation

Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

windows

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

windows · process_creation

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

windows · process_creation

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

aws

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

azure

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

azure

Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

windows · process_access

Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.

gcp

Detects the creation of doas.conf file in linux host platform.

linux · file_event

Monitor and alert on conditional access changes.

azure

Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.

linux · file_event

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

linux · process_creation

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

windows · process_creation

Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.

windows · process_creation

Detects non-system users performing privileged operation os the SCM database

windows

A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

windows · process_creation

Detects modifications to shell open registry keys that point to suspicious locations typically used by malware for persistence. Generally, modifications to the `*\shell\open\command` registry key can indicate an attempt to change the default action for opening files, and various UAC bypass or persistence techniques involve modifying these keys to execute malicious scripts or binaries.

windows · registry_set

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

windows · process_creation

Detects when an attacker tries to disable User Account Control (UAC) by setting the registry value "EnableLUA" to 0.

windows · registry_set

Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed.

windows · registry_set

Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.

windows · registry_set

Monitor and alert on group membership additions of groups that have CA policy modification access

azure

Monitor and alert on group membership removal of groups that have CA policy modification access

azure

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

aws

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

aws

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

linux

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

linux · process_creation

Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.

linux · process_creation

Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.

linux · process_creation

Detects suspicious change of file privileges with chown and chmod commands

linux · process_creation