BeepRAT UAC Bypass via HFY.exe Spawning Elevated Process
This rule detects scenarios where an unknown or suspicious executable (named HFY.exe) interacts with Windows binaries commonly used for User Account Control (UAC) bypass attacks, such as eventvwr.exe, fodhelper.exe, and consent.exe. The detection monitors process creation events (Sysmon Event ID 1 or Windows Event ID 4688) for direct execution or parent-child relationships involving these binaries, which are often used to elevate privileges without user interaction.
Splunk (SPL)
