T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control - ChocoShell UAC Bypass Temp Marker Creation
ChocoShell attempts UAC bypass for privilege escalation leveraging SilentCleanup and creates a blank .tmp file in the process via the command line: cmd /c echo.>"C:\Users\<u>\AppData\Local\Temp\.<hexTickCount>.tmp", with the file being up to 8 chars long. One should expect to see svchost as the parent process to cmd.exe given that SilentCleanup runs as a service that resolves %windir% from a hijacked HKCU:\Environment\windir variable.
Microsoft Sentinel (KQL)
