Fileless UAC Bypass with ComputerDefaults.exe and Outbound Network Connection
This rule detects the execution of 'ComputerDefaults.exe' without command-line arguments, which is a known method for User Account Control (UAC) bypass. It then correlates this activity with outbound network connections to specific ports (5443, 8041, 8443, 80, 443), indicating potential post-exploitation communication or data exfiltration after privilege escalation.
Microsoft Sentinel (KQL)
