Windows Explorer spawned with /NOUACCHECK flag

Alerts on explorer.exe executions that include /NOUACCHECK, indicating potential bypass of UAC checks for child processes.

FreeUnreviewedSigmahighv1

windows-explorer-spawned-with-nouaccheck-flag-534f2ef7

title: Windows Explorer spawned with /NOUACCHECK flag
id: 4b2692e9-0efa-4f6d-878d-fb2c6898c513
status: test
description: This rule flags process creation events where explorer.exe is started with the /NOUACCHECK command-line flag. The flag behavior matters because it can allow child processes of the newly started explorer.exe to run without UAC checks. The detection relies on Windows process creation telemetry, matching explorer.exe in the image path and searching for /NOUACCHECK in the command line while excluding executions with specific scheduled-task related parent process patterns.
references:
  - https://twitter.com/ORCA6665/status/1496478087244095491
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-23
modified: 2022-04-21
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \explorer.exe
    CommandLine|contains: /NOUACCHECK
  filter_dc_logon:
    - ParentCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    - ParentImage: C:\Windows\System32\svchost.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Domain Controller User Logon
  - Unknown how many legitimate software products use that method
level: high
license: DRL-1.1
related:
  - id: 534f2ef7-e8a2-4433-816d-c91bccde289b
    type: derived

What it detects

This rule flags process creation events where explorer.exe is started with the /NOUACCHECK command-line flag. The flag behavior matters because it can allow child processes of the newly started explorer.exe to run without UAC checks. The detection relies on Windows process creation telemetry, matching explorer.exe in the image path and searching for /NOUACCHECK in the command line while excluding executions with specific scheduled-task related parent process patterns.

Known false positives

Domain Controller User Logon
Unknown how many legitimate software products use that method

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.