UAC bypass via command handler hijacking

Detects attempts to bypass User Account Control (UAC) by hijacking command handler registry keys associated with auto-elevated system components. Attackers abuse this technique to redirect execution flow and spawn elevated processes without user consent.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Escalada de privilegios
• Técnicas MITRE: T1548, T1548.002

Volver a todas las reglas