Uac Bombing Attempt Followed By Lolbas Process Launch
Detects a high frequency of UAC consent prompts (consent.exe) originating from a single parent process, followed by the launch of a common Living Off The Land Binary (LOLBAS). This pattern is indicative of 'UAC Prompt Bombing' used to coerce a user into granting elevated privileges, as seen with the NightshadeC2 loader.
YARA-L
