UAC Bypass Technique Payload Download Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the download of a payload that might be used in a User Account Control (UAC) bypass technique. It specifically looks for HTTP traffic where the URI contains keywords like 'uac.bypass', 'elevate', 'privesc', or 'bypassuac' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.