UAC Bypass Using MSConfig Token Modification - Process

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•13

Detects a specific UAC bypass technique involving the modification of the msconfig token, often associated with tools like UACMe (specifically method 55). The rule looks for a process with High or System integrity level, whose parent process is 'pkgmgr.exe' located in a temporary directory, and executes 'msconfig.exe' with the '-5' command-line argument.