Suspicious Child Processes of consent.exe

The Windows binary consent.exe is responsible for rendering the User Account Control (UAC) elevation dialog. Under normal operating conditions, this process should not spawn any child processes, with the exception of WerFault.exe during rare system crash scenarios. Security researchers and incident responders have identified that the spawning of arbitrary child processes by consent.exe is a reliable indicator of UAC bypass exploits and privilege escalation. Attackers utilize these techniques to achieve elevated privileges without triggering a visible user prompt, effectively bypassing standard Windows security boundaries. This behavior is frequently associated with post-exploitation frameworks targeting Windows environments, particularly in the context of CVE-2024-30051. Detection of this activity is critical for identifying local privilege escalation attempts where attackers attempt to maintain stealth during the elevation phase.

Impact

Successful exploitation of UAC bypass techniques allows unauthorized users to gain elevated system privileges. This provides an attacker with the ability to execute malicious payloads with administrative rights, potentially leading to full system compromise, exfiltration of sensitive data, or the deployment of secondary malware. These techniques are often utilized during the post-exploitation phase to gain persistence and deeper access within target networks.

Recommendation

• Enable Sysmon Event ID 1 (Process Creation) or Windows Event ID 4688 to capture parent-child process relationships.
• Deploy the provided Sigma rule to identify and alert on non-WerFault.exe processes spawned by consent.exe.
• Investigate all alerts originating from consent.exe immediately, as legitimate software rarely triggers this behavior.
• Cross-reference identified processes with known administrative tools to rule out authorized maintenance activity.