Windows Process Creation: UAC bypass attempt via MMC Windows Firewall Snap-in hijack

title: "Windows Process Creation: UAC bypass attempt via MMC Windows Firewall Snap-in hijack"
id: 9f945a5a-e3a5-4f21-8b65-755afd1ad408
status: test
description: This rule flags process executions where a parent process running MMC (mmc.exe) launches Windows Firewall management by using a command line containing WF.msc. This behavior matters because attackers may use the Windows Firewall snap-in context to attempt a UAC bypass. The detection relies on process creation telemetry, matching parent process image and parent command-line content while excluding events where the child image ends with WerFault.exe.
references:
  - https://www.elastic.co/guide/en/security/current/uac-bypass-via-windows-firewall-snap-in-hijack.html#uac-bypass-via-windows-firewall-snap-in-hijack
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-27
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \mmc.exe
    ParentCommandLine|contains: WF.msc
  filter:
    Image|endswith: \WerFault.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e52cb31c-10ed-4aea-bcb7-593c9f4a315b
    type: derived