Bypass UAC Using SilentCleanup Task via windir Environment Variable Modification
Detects when the 'windir' environment variable is modified from its default value. This modification is often a precursor to a User Account Control (UAC) bypass technique leveraging the 'SilentCleanup' scheduled task, which is an auto-elevated task that can execute with administrator privileges without prompting the user.
Sigma
