Windows File Write to Temp pkgmgr.exe via msconfig Token Modification (UAC bypass technique)

title: Windows File Write to Temp pkgmgr.exe via msconfig Token Modification (UAC bypass technique)
id: 4005391b-a67b-45c3-ae21-aa15ae09ba38
status: test
description: This rule flags file activity where the target path starts under C:\Users\ and ends with \AppData\Local\Temp\pkgmgr.exe, consistent with staging a UAC bypass payload using a msconfig GUI hack. Attackers may use this method to prepare execution artifacts in user-writable locations to attempt elevated execution. It relies on file event telemetry that captures the destination file path (TargetFilename) of write operations.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Users\
    TargetFilename|endswith: \AppData\Local\Temp\pkgmgr.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 41bb431f-56d8-4691-bb56-ed34e390906f
    type: derived