Bypass UAC Using DelegateExecute Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects attempts to bypass User Account Control (UAC) by modifying the registry to leverage the DelegateExecute verb. Specifically, it looks for modifications to registry keys ending with '\open\command\DelegateExecute' where the 'Details' field is empty, which is indicative of a fileless UAC bypass technique.