Windows Registry: Detect DelegateExecute UAC bypass via TargetObject path

title: "Windows Registry: Detect DelegateExecute UAC bypass via TargetObject path"
id: bf63891e-efa8-40d1-86b2-c56083dcd6cd
status: test
description: This rule flags registry set activity where the TargetObject ends with '\open\command\DelegateExecute' and the Details field is empty. Attackers can use DelegateExecute mechanisms to attempt privilege escalation by bypassing UAC using method chains that rely on registry-stored COM command execution. The detection relies on telemetry from Windows registry set events, matching the specific TargetObject path pattern and an empty Details value.
references:
  - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
  - https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml
author: frack113, Huntrule Team
date: 2022-01-05
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \open\command\DelegateExecute
    Details: (Empty)
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute/info.yml
simulation:
  - type: atomic-red-team
    name: Bypass UAC using sdclt DelegateExecute
    technique: T1548.002
    atomic_guid: 3be891eb-4608-4173-87e8-78b494c029b7
license: DRL-1.1
related:
  - id: 46dd5308-4572-4d12-aa43-8938f0184d4f
    type: derived