UNC5221 SNOWLIGHT UAC Bypass via requireAdministrator Auto-Elevation (T1548.002)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects unauthorized User Account Control (UAC) bypass attempts involving the SNOWLIGHT dropper (UNC5221). The rule identifies child processes running at High or System integrity levels that were spawned by a Medium integrity parent process. It specifically triggers when the child binary contains a 'requireAdministrator' manifest, suggesting silent elevation without a user prompt, and exhibits process token impersonation capabilities.