UAC bypass via CDSSync scheduled task hijack
Identifies attempts to bypass User Account Control (UAC) by hijacking the CDSSync scheduled task through a malicious npmproxy.dll. Such behavior is indicative of a UAC bypass technique where attackers abuse auto-elevated scheduled tasks to execute code with elevated privileges.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Escalada de privilegios
- Técnicas MITRE: T1548, T1548.002