huntrule

Windows Process Creation: UAC bypass attempt via MMC Windows Firewall Snap-in hijack

Alerts when MMC launches WF.msc, a possible UAC bypass snap-in hijack pattern, excluding WerFault.exe-related cases.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
Published
2022-09-27
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions where a parent process running MMC (mmc.exe) launches Windows Firewall management by using a command line containing WF.msc. This behavior matters because attackers may use the Windows Firewall snap-in context to attempt a UAC bypass. The detection relies on process creation telemetry, matching parent process image and parent command-line content while excluding events where the child image ends with WerFault.exe.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange
Suspicious User Home Directory Modification via dscl Process Creation
Possible GTFOBins Shell Breakout via apt Command
Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation
Malicious macOS Credential Verification via dscl authonly
Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)
Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)
Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes
Linux setcap sets cap_setgid on binaries (Setgid capability assignment)
Linux setcap sets cap_setuid on a binary via setcap utility
Windows Process Creation: UAC bypass attempt via MMC Windows Firewall Snap-in hijack
Pivot detection · T1548 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.