Suspicious UAC Bypass through Windows Firewall Snap-In Hijack (via process_creation)

title: Suspicious UAC Bypass through Windows Firewall Snap-In Hijack (via process_creation)
id: 456e4d80-6e70-5d13-a599-90add2c52047
status: stable
description: This rule detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in
references:
    - https://attack.mitre.org/techniques/T1548/
    - https://www.elastic.co/guide/en/security/current/uac-bypass-via-windows-firewall-snap-in-hijack.html#uac-bypass-via-windows-firewall-snap-in-hijack
author: Huntrule Team
date: 2026-02-05
tags:
    - attack.privilege-escalation
    - attack.t1548
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\mmc.exe'
        ParentCommandLine|contains: 'WF.msc'
    filter:
        Image|endswith: '\WerFault.exe'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium