UAC bypass via assembly Native Image Cache hijack

Detects attempts to bypass User Account Control (UAC) by hijacking the .NET Native Image Cache (NativeImages) through unauthorized assembly creation followed by execution of a high-integrity process.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1548, T1548.002

Back to all rules