TrustedPath UAC Bypass Pattern Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•21

This rule detects a specific UAC bypass method known as 'TrustedPath UAC Bypass'. This technique involves creating specially crafted directories that mimic legitimate Windows system paths (e.g., 'C:\Windows \System32\') to trick the operating system into executing an untrusted application with elevated privileges without a UAC prompt. The detection logic specifically looks for process creation events where the image path contains these malformed system directory names.