UAC Bypass via Consent.exe and Werfault.exe
This rule detects a specific User Account Control (UAC) bypass technique often associated with UACMe (specifically method 22). It triggers when 'werfault.exe' is spawned with high or system integrity levels, and its parent process is 'consent.exe'. This indicates an attempt to elevate privileges by exploiting a vulnerability in how consent.exe handles process creation, leading to an auto-elevated werfault.exe.
Sigma
