Potential UAC Bypass via Command Line

Ankit Mehta@Secvyn

•updated Jun 13, 2026•1•0•6

This rule detects the creation of new processes (EventID 4688) where the command line contains keywords commonly associated with User Account Control (UAC) bypass techniques, such as 'uac', 'UAC', or 'bypassuac'. This could indicate an attempt to elevate privileges without user consent.