Detection of Sdclt UAC Bypass via Process Spawning

The Windows Backup and Restore application, sdclt.exe, is a binary that runs with auto-elevated privileges. Threat actors have historically abused this binary to perform UAC bypass techniques. By manipulating specific registry keys (typically related to Shell\Open\command in the registry hive associated with the application's configuration), an attacker can force sdclt.exe to execute an arbitrary payload or process. Because the parent process sdclt.exe is auto-elevated, the resulting child process inherits these administrative privileges, effectively bypassing the UAC prompt that would otherwise appear when executing privileged tasks. This technique is a well-documented method for privilege escalation on Windows systems and remains a relevant behavioral indicator for security operations centers monitoring for suspicious process lineage.

Attack Chain

1. Attacker identifies a target system where code execution is already achieved at a medium-integrity level.
2. Attacker modifies specific registry keys (e.g., HKCU\Software\Classes\Folder\shell\open\command) to point to a malicious binary or script.
3. Attacker executes sdclt.exe via command line or scheduled task.
4. The operating system launches sdclt.exe due to its auto-elevation manifest.
5. sdclt.exe accesses the manipulated registry key to determine its startup behavior.
6. sdclt.exe spawns the attacker-controlled binary as a child process.
7. The child process executes with high-integrity (administrative) permissions.
8. Attacker achieves local privilege escalation to perform post-exploitation activities.

Impact

Successful exploitation of this technique allows an attacker to transition from a standard user context to an administrative context without triggering a UAC prompt. This escalation is a critical step in maintaining persistence, dumping credentials from memory (e.g., LSASS access), or installing rootkits, ultimately leading to full system compromise.

Recommendation

1. Deploy the provided Sigma rule to monitor for any child processes spawned by sdclt.exe, as this behavior is rare in standard administrative environments.
2. Baseline your environment to identify legitimate uses of sdclt.exe. In most enterprise environments, sdclt.exe should not be spawning child processes.
3. Monitor registry modifications targeting the Classes\Folder\shell\open\command paths if high-value endpoints show signs of compromise.