huntrule

Windows Process Creation Matching TrustedPath UAC Bypass Directory Mocking Strings

Alerts on Windows processes referencing System32/SysWOW64 paths consistent with TrustedPath UAC bypass directory mocking.

FreeUnreviewedSigmacriticalv1
title: Windows Process Creation Matching TrustedPath UAC Bypass Directory Mocking Strings
id: e72ad523-14a6-4b22-a5a5-30345f9f038c
related:
  - id: 0cbe38c0-270c-41d9-ab79-6e5a9a669290
    type: similar
  - id: 4ac47ed3-44c2-4b1f-9d51-bf46e8914126
    type: derived
status: test
description: This rule flags Windows process creation events whose command line or image field contains the system directory paths associated with TrustedPath UAC bypass techniques (C:\Windows\System32\ and C:\Windows\SysWOW64\). Such behavior can indicate an attempt to interfere with how elevated components resolve trusted locations to gain privilege without proper authorization. It relies on process creation telemetry and string matching on the observed process Image field.
references:
  - https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e
  - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows
  - https://github.com/netero1010/TrustedPath-UACBypass-BOF
  - https://x.com/Wietze/status/1933495426952421843
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-27
modified: 2025-06-17
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - C:\Windows \System32\
      - C:\Windows \SysWOW64\
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1

What it detects

This rule flags Windows process creation events whose command line or image field contains the system directory paths associated with TrustedPath UAC bypass techniques (C:\Windows\System32\ and C:\Windows\SysWOW64\). Such behavior can indicate an attempt to interfere with how elevated components resolve trusted locations to gain privilege without proper authorization. It relies on process creation telemetry and string matching on the observed process Image field.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.