Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

1 rule found for "Omer Yampel"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest

UAC Bypass via Sdclt

Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)

WindowsRegistry Set
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1548.002 · Bypass User Account Control2019-04-001 · CAR 2019-04-001
Omer Yampel+1Fri Mar 17windows