Detectionmediumtest

UAC Bypass via Windows Firewall Snap-In Hijack

Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Tim Rauch, Elastic SecurityCreated Tue Sep 27e52cb31c-10ed-4aea-bcb7-593c9f4a315bwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        ParentImage|endswith: '\mmc.exe'
        ParentCommandLine|contains: 'WF.msc'
    filter:
        Image|endswith: '\WerFault.exe'
    condition: selection and not filter
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

Rule Metadata
Rule ID
e52cb31c-10ed-4aea-bcb7-593c9f4a315b
Status
test
Level
medium
Type
Detection
Created
Tue Sep 27
Path
rules/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml
Raw Tags
attack.defense-evasionattack.privilege-escalationattack.t1548
View on GitHub