UAC bypass via rouge MMC snap-in
Detects attempts to bypass User Account Control (UAC) by executing a malicious Microsoft Management Console (MMC) snap-in. Abuse of MMC snap-ins for UAC bypass is typically observed in post-exploitation scenarios where an adversary already has code execution in a user context and is attempting to escalate privileges to administrator.
- Platform: Windows
- Severity: High
- MITRE Tactic: Privilege Escalation
- MITRE Techniques: T1548, T1548.002