UAC bypass via CDSSync scheduled task hijack

Identifies attempts to bypass User Account Control (UAC) by hijacking the CDSSync scheduled task through a malicious npmproxy.dll. Such behavior is indicative of a UAC bypass technique where attackers abuse auto-elevated scheduled tasks to execute code with elevated privileges.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1548, T1548.002

Back to all rules