UAC Bypass Using Consent.exe and Comctl32.dll File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.