Create file_event_win_uac_bypass_eventvwr.yml

2022-04-27 10:54:36 +02:00
parent 182c81af5a
commit 8fdae70307
1 changed files with 24 additions and 0 deletions
@@ -0,0 +1,24 @@
+title: UAC Bypass Using EventVwr
+id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
+description: Detects the pattern of a UAC bypass using Windows Event Viewer
+author: Antonio Cocomazzi (idea), Florian Roth (rule)
+date: 2022/04/27
+status: experimental
+references:
+    - https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw
+    - https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
+tags:
+    - attack.defense_evasion
+    - attack.privilege_escalation
+logsource:
+    category: file_event
+    product: windows
+detection:
+    selection:
+        TargetFilename|contains: '\AppData\Local\Microsoft\Event Viewer\RecentViews'
+    filter:
+        Level: 4
+    condition: selection and not filter
+falsepositives:
+    - Unknown
+level: high