diff --git a/rules/windows/sysmon/sysmon_sdclt_uac_bypass.yml b/rules/windows/sysmon/sysmon_sdclt_uac_bypass.yml
new file mode 100644
index 000000000..5894a2f64
--- /dev/null
+++ b/rules/windows/sysmon/sysmon_sdclt_uac_bypass.yml
@@ -0,0 +1,17 @@
+title: SDCLT UAC Bypass detection 
+status: experimental
+description: Detects changes to HKCU:\Software\Classes\exefile\shell\runas\command\isolatedCommand
+reference: https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
+author: Omer Yampel
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selector:
+        EventID: 13 
+    TargetObject:
+        - 'HKCU:\Software\Classes\exefile\shell\runas\command\isolatedCommand'
+    condition: selection
+falsepositives:
+    - unknown
+level: high