UAC bypass via assembly Native Image Cache hijack

Detects attempts to bypass User Account Control (UAC) by hijacking the .NET Native Image Cache (NativeImages) through unauthorized assembly creation followed by execution of a high-integrity process.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Escalada de privilegios
• Técnicas MITRE: T1548, T1548.002

Volver a todas las reglas