HackTool - UACMe Akagi Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•20

Detects the execution of UACMe, a tool used for User Account Control (UAC) bypasses, by identifying specific PE metadata (Product, Company, Description, OriginalFileName) or image names. It also includes a selection of known IMPHASH values associated with UACMe's 'Akagi' component.