UAC Bypass Registry Key Deletion

Jorden Smith@Jorden

•updated Feb 10, 2026•0•15

The rule detects the deletion of specific registry keys associated with UAC bypass techniques. Specifically, it looks for deletions where the 'TargetObject' field contains the string '\ms-settings\Shell\Open\command'. This activity is indicative of anti-forensics, as an attacker might delete these keys to remove evidence of privilege escalation after performing a UAC bypass.