ChocoShell UAC bypass via SilentCleanup, wsreset, and sdclt auto-elevation abuse
Detects User Account Control (UAC) bypass techniques associated with ChocoShell. The rule monitors for specific malicious patterns: the execution of 'schtasks.exe' to trigger the 'SilentCleanup' task, the spawning of unexpected child processes from 'wsreset.exe' or 'sdclt.exe', and the invocation of 'sdclt.exe' with the '/KickOffElev' argument. These behaviors are indicative of an attacker attempting to elevate privileges by abusing Windows auto-elevating binaries.
Microsoft Sentinel (KQL)
