ChocoShell UAC Bypass via SilentCleanup/wsreset.exe/sdclt.exe Registry Hijacks with Anti-Forensic Cleanup
Detects UAC bypass attempts abusing SilentCleanup, wsreset.exe, or sdclt.exe via registry hijacks, correlated with the subsequent auto-elevated execution, plus anti-forensic cleanup indicators.
Cortex XDR
