CmdID

CmdID / Rules / Windows

UAC Bypass via ICMLuaUtil

A Sigma rule for process creation on Windows, by Florian Roth (Nextron Systems), Elastic (idea).

high 1 ATT&CK technique 2 programs it names

What it looks for

its detection, as SigmaHQ writes it
detection:
  filter:
    - Image|endswith: '\WerFault.exe'
    - OriginalFileName: 'WerFault.exe'
  selection:
    ParentCommandLine|contains:
      - '/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
      - '/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}'
    ParentImage|endswith: '\dllhost.exe'
  condition: selection and not filter

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Florian Roth (Nextron Systems), Elastic (idea), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

None of the everyday examples and documented commands on CmdID’s program pages trips it. To see whether a command line does, paste it into CmdID.

Programs and files it names

their pages here
WerFault.exedllhost.exe

ATT&CK

the techniques it is tagged with
T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Other rules for T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

PowerShell Web Access Feature Enabled Via DISM · Potentially Suspicious Event Viewer Child Process · Explorer NOUACCHECK Flag · HackTool - Empire PowerShell UAC Bypass · HackTool - UACMe Akagi Execution · Always Install Elevated Windows Installer · Always Install Elevated MSI Spawned Cmd And Powershell · UAC Bypass Using ChangePK and SLUI · UAC Bypass Using Disk Cleanup · UAC Bypass Tools Using ComputerDefaults · UAC Bypass Using Consent and Comctl32 - Process · UAC Bypass Using IEInstal - Process