Potential Privilege Escalation Using Symlink Between Osk and Cmd

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•0

Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.