All Detections

Potential UAC Bypass Via Sdclt.EXE

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Sigma