UAC Bombing Detection – Repeated Denied UAC Prompts by Initiator
Detects repeated denied UAC elevation attempts (UAC "prompt storms") initiated by the same process within a short time frame. This detection is based entirely on Microsoft Defender for Endpoint (MDE) telemetry from DeviceProcessEvents and is useful in environments where traditional SecurityEvent logs (e.g. Event ID 4688) are unavailable or not ingested. It identifies patterns where a process consistently triggers `consent.exe` (the UAC prompt), but no elevated child process follows — indicating the prompt was denied or ignored. This is particularly useful for detecting UAC bombing attacks, where a malicious process tries to overwhelm the user with repeated elevation prompts to bypass security friction.
Microsoft Sentinel (KQL)
