Detecting Potential Bypass of User Account Control (UAC) via Shell Open Command
This rule detects attempts to delete registry keys associated with the "ms-settings" URI scheme, specifically targeting the "Shell\Open\command" subkey. This activity could indicate an attempt to remove or disable a custom URI handler, which might be used by malware for persistence or execution. The rule focuses on Sysmon EventCode 12 (RegistryEvent) with EventType "DeleteKey" and a TargetObject matching "*\\ms-settings\\Shell\\Open\\command*". This could be an indicator of an attacker trying to clean up their tracks or disrupt legitimate system functionality.
Splunk (SPL)
