Tag
UAC Bypass Attempt via Windows Directory Masquerading
2 rules 1 TTPDetects attempts to bypass User Account Control (UAC) by masquerading as a trusted Microsoft Windows directory, abusing a trailing-space in the path to execute code with elevated privileges.
UAC Bypass via Event Viewer
2 rules 1 TTPDetects User Account Control (UAC) bypass attempts using eventvwr.exe to execute code with elevated permissions by identifying child processes of eventvwr.exe, excluding mmc.exe and WerFault.exe, which may indicate unauthorized privilege escalation.
UAC Bypass via ICMLuaUtil Elevated COM Interface
2 rules 1 TTPDetects User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface, where attackers may attempt to stealthily execute code with elevated permissions, potentially leading to privilege escalation.
UAC Bypass via Windows Firewall MMC Snap-In Hijack
2 rules 2 TTPsAttackers bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in to execute code with elevated permissions, potentially leading to system compromise.
UAC Bypass via DiskCleanup Scheduled Task Hijack
2 rules 3 TTPsAttackers bypass User Account Control (UAC) by hijacking the DiskCleanup Scheduled Task to stealthily execute code with elevated permissions on Windows systems.
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
2 rules 3 TTPsThis threat brief details a UAC bypass technique leveraging the Internet Explorer Add-On Installer (ieinstal.exe) and Component Object Model (COM) to execute arbitrary code with elevated privileges.