T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control - ChocoShell Unified UAC Bypass Detection Query
This detection query hits on 3 separate ways ChochShell attempts to bypass UAC to elevate privileges: leveraging the %windir% Env variable that gets picked up by SilentCleanup running under elevated permissions, sdclt.exe hijack via Windows Backup, and WSReset COM handler key write followed by WSReset.exe spawning to execute the key.
Microsoft Sentinel (KQL)
