SilentCanvas - MS-Settings UAC Bypass (T1548.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Correlates the malicious ms-settings registry hijack with the execution of the auto-elevating ComputerDefaults.exe. This rule detects a specific UAC bypass technique where an attacker modifies the 'ms-settings' registry key to point to a malicious executable, which is then launched when 'ComputerDefaults.exe' is executed, leading to privilege escalation.