AN1094
Analytic 1094
Windows
Detects a multi-event behavior chain involving UAC bypass attempts via known auto-elevated binaries (e.g., eventvwr.exe, sdclt.exe), unauthorized Registry changes to UAC-related keys, and anomalous process execution with elevated privileges but lacking standard parent-child lineage. Suspicious patterns include invocation of auto-elevated COM objects or manipulation of isolatedCommand Registry entries without consent prompts.
WinEventLog:Security
EventCode=4688
WinEventLog:Security
EventCode=4672
WinEventLog:Sysmon
EventCode=13, 14
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=7
[TimeWindow]
Correlate registry tampering and elevation within a tunable time window (e.g., 30 seconds) to reduce noise from benign admin activity.
[ElevatedProcessNameList]
Tunable list of suspicious elevated binaries (e.g., sdclt.exe, eventvwr.exe, computerdefaults.exe) known to support UAC bypass.
[ParentProcessAnomalyThreshold]
Define logic for parent-child mismatch (e.g., non-elevated process spawning auto-elevated one) to flag uncommon elevation paths.