Create sysmon_sdclt_uac_bypass.yml

UAC Bypass from https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/. Sorry in advance for not being 100% about the sysmon event ids / fields
2017-03-17 14:31:26 -04:00
parent 59499f926e
commit d3bd73aefb
1 changed files with 17 additions and 0 deletions
@@ -0,0 +1,17 @@
+title: SDCLT UAC Bypass detection 
+status: experimental
+description: Detects changes to HKCU:\Software\Classes\exefile\shell\runas\command\isolatedCommand
+reference: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
+author: Omer Yampel
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selector:
+        EventID: 13 
+    TargetObject:
+        - 'HKCU:\Software\Classes\exefile\shell\runas\command\isolatedCommand'
+    condition: selection
+falsepositives:
+    - unknown
+level: high