Explorer.exe NOUACCHECK Flag Usage
This rule detects the suspicious execution of 'explorer.exe' with the '/NOUACCHECK' command-line flag. This flag can be used to bypass User Account Control (UAC) checks for all subprocesses launched by the newly started explorer.exe instance, potentially allowing an attacker to elevate privileges or execute malicious code without user interaction. The rule filters out legitimate instances where 'explorer.exe' is launched by the Windows Task Scheduler service ('svchost.exe -k netsvcs -p -s Schedule').
Sigma
