UAC bypass via HKCU ms-settings/mscfile shell open command hijack

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•0•0•4

Detects registry-based User Account Control (UAC) bypass activity where command keys for ms-settings or mscfile are created or modified under HKCU Software\Classes, correlated with a privilege adjustment (SeDebugPrivilege or SeLoadDriverPrivilege) by the same process within a 30-minute window.