UAC bypass via command handler hijacking

Detects attempts to bypass User Account Control (UAC) by hijacking command handler registry keys associated with auto-elevated system components. Attackers abuse this technique to redirect execution flow and spawn elevated processes without user consent.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1548, T1548.002

Back to all rules