UAC Bypass Using Disk Cleanup via Scheduled Task
This rule detects a specific User Account Control (UAC) bypass technique that leverages the Disk Cleanup utility (cleanmgr.exe) in conjunction with scheduled tasks. The detection logic looks for a process creation event where 'cleanmgr.exe' is executed with the '/autoclean /d C:' arguments, and its parent process is 'svchost.exe -k netsvcs -p -s Schedule', indicating it was launched by the Task Scheduler service. Furthermore, the rule specifies that the integrity level of the 'cleanmgr.exe' process must be 'High' or 'System', which is indicative of an elevated process, thus confirming a successful UAC bypass. This technique is associated with UACMe method 34.
Sigma
