Potential UAC Bypass Via Sdclt.EXE

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•13

This rule detects the execution of 'sdclt.exe' with elevated privileges (High integrity level). This behavior is often indicative of an attempt to bypass User Account Control (UAC) mechanisms on Windows systems. Attackers may leverage sdclt.exe, a legitimate Windows utility, to execute arbitrary commands or processes with administrative rights without triggering a UAC prompt.