UAC Bypass Using ChangePK and SLUI
Detects a specific User Account Control (UAC) bypass technique that leverages the 'changepk.exe' and 'slui.exe' executables. This method is associated with UACMe bypass technique #61, where 'slui.exe' is used as a parent process to launch 'changepk.exe' with elevated privileges, bypassing the UAC prompt. The rule specifically looks for 'changepk.exe' being spawned by 'slui.exe' with an integrity level of 'High' or 'System'.
Sigma
