BeepRAT UAC Bypass via UAC_x86/x64 Component Loading Appinfo
Detects the execution of tcc.exe with command-line arguments indicative of file operations often associated with UAC bypass techniques. The rule also monitors for the loading of UAC-related DLLs or child processes by tcc.exe, which further suggests activity aimed at gaining elevated privileges.
Microsoft Sentinel (KQL)
