UAC Bypass Using IEInstal.exe - File Creation
This rule detects a specific pattern indicative of a User Account Control (UAC) bypass technique using 'IEInstal.exe'. Specifically, it looks for 'IEInstal.exe' creating a file named 'consent.exe' within a user's temporary application data directory (e.g., 'C:\Users\<username>\AppData\Local\Temp\'). This behavior is characteristic of UACMe, an open-source tool designed to exploit various UAC bypass methods.
Sigma
