UAC Bypass Using IEInstal.exe (UACMe 64)

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•15

Detects a specific User Account Control (UAC) bypass technique leveraging 'ieinstal.exe' as a parent process. The rule looks for processes with 'High' or 'System' integrity levels, where the parent process is 'ieinstal.exe' and the created process is 'consent.exe' located in a temporary directory ('\AppData\Local\Temp\'). This pattern is characteristic of the UACMe tool's method 64.