All Detections

UAC Bypass Using Disk Cleanup

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Sigma