Windows explorer.exe spawned with /NOUACCHECK flag for UAC bypass behavior

Alerts on explorer.exe executions that include /NOUACCHECK, indicating potential bypass of UAC checks for child processes.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-02-23
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.002Bypass User Account Control
Defense Evasion
- T1548.002Bypass User Account Control
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies process creation events where explorer.exe is started with the /NOUACCHECK flag, which can allow child processes to run without UAC checks. Attackers may use this to bypass User Account Control protections during a staged execution via a newly spawned explorer instance. The rule relies on process creation telemetry including the image path and command-line arguments, and it excludes events where the parent command line matches a scheduled-task related svchost invocation.

Reporting behind it

Related detections9 linkedT1548.002 — drag to rearrange

Malicious FodHelper UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

Malicious UAC Bypass via sdclt Handler Hijack (via registry_set)

Malicious UAC Bypass via ms-settings Handler Hijack (via registry_set)

Malicious DBatLoader DLL Sideloading via easinvoker.exe Loading netutils.dll (via image_load)

Suspicious dllhost.exe Spawned with CLSID and Anomalous Parent (via process_creation)

Malicious ms-settings DelegateExecute UAC Bypass Registry Change

Malicious User Account Control Bypass via Auto-Elevating Binary Hijack (via process_creation)

Suspicious Mock Trusted Directory with Trailing Space (via process_creation)

Windows explorer.exe spawned with /NOUACCHECK flag for UAC bypass behavior

Pivot detection · T1548.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-explorer-spawned-with-nouaccheck-flag-534f2ef7

title: Windows explorer.exe spawned with /NOUACCHECK flag for UAC bypass behavior
id: 4b2692e9-0efa-4f6d-878d-fb2c6898c513
status: test
description: Identifies process creation events where explorer.exe is started with the /NOUACCHECK flag, which can allow child processes to run without UAC checks. Attackers may use this to bypass User Account Control protections during a staged execution via a newly spawned explorer instance. The rule relies on process creation telemetry including the image path and command-line arguments, and it excludes events where the parent command line matches a scheduled-task related svchost invocation.
references:
  - https://twitter.com/ORCA6665/status/1496478087244095491
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-23
modified: 2022-04-21
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \explorer.exe
    CommandLine|contains: /NOUACCHECK
  filter_dc_logon:
    - ParentCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    - ParentImage: C:\Windows\System32\svchost.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Domain Controller User Logon
  - Unknown how many legitimate software products use that method
level: high
license: DRL-1.1
related:
  - id: 534f2ef7-e8a2-4433-816d-c91bccde289b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL