UAC bypass via Program Compatibility Assistant scheduled task hijack

Detects attempts to bypass User Account Control (UAC) by abusing the Program Compatibility Assistant (PCA) scheduled task to achieve unauthorized privilege escalation. Adversaries can leverage a trusted Windows component and its associated task execution context to spawn elevated processes without triggering standard UAC consent prompts.

• Platform: Windows
• Severity: High
• MITRE Tactic: Privilege Escalation
• MITRE Techniques: T1548, T1548.002

Back to all rules