Fake system root environment variable manipulation

Identifies attempts to manipulate user-scoped Windows directory registry values to point to non-standard locations, a technique commonly abused to fake the system root directory and enable privilege escalation.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1068

Back to all rules