SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,481 copies16 likes159,623 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)
Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.
Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in
Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface
Detects the "IDiagnosticProfileUAC" UAC bypass technique
Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)
A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.
Page 145 of 680