UAC Bypass Using MSConfig Token Modification - File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects a specific User Account Control (UAC) bypass technique that involves modifying the msconfig GUI. This rule specifically looks for the creation of a file named 'pkgmgr.exe' within a user's temporary directory, which is a known indicator for the UACMe bypass method 55.