UAC Bypass Using ComputerDefaults.exe

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•15

This rule detects attempts to bypass User Account Control (UAC) using the 'ComputerDefaults.exe' utility, specifically when it is executed with elevated integrity levels (High or System) and not as a child process of common system directories like 'System32' or 'Program Files'. This behavior is characteristic of UAC bypass tools such as UACMe (method 59).