UAC bypass via NTFS junction DLL hijacking

Detects potential User Account Control (UAC) bypass activity leveraging NTFS junctions in combination with DLL hijacking to achieve elevated code execution. Attackers can manipulate filesystem redirection features to coerce trusted Windows components into loading malicious libraries.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1548, T1548.002

Back to all rules