All Detections

UAC Bypass Using NTFS Reparse Point - File

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Sigma