Windows Registry: Detect windir Environment Key Changes for SilentCleanup UAC Bypass

title: "Windows Registry: Detect windir Environment Key Changes for SilentCleanup UAC Bypass"
id: 487b66b6-c01d-4e6b-ab85-8c4ed885834f
status: test
description: This rule flags registry set activity where the Environment\windir key is written to a non-default value. Attackers may modify windir to influence an auto-elevated cleanup task (SilentCleanup) that resides under %windir%\System32\cleanmgr.exe, enabling privilege escalation without UAC prompting. The detection relies on registry set telemetry targeting the Environment\windir path and excludes writes that match the default %SystemRoot% value.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task
  - https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/
  - https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml
author: frack113, Nextron Systems, Huntrule Team
date: 2022-01-06
modified: 2024-01-30
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Environment\windir
  filter_main_default:
    Details: "%SystemRoot%"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/info.yml
simulation:
  - type: atomic-red-team
    name: Bypass UAC using SilentCleanup Task
    technique: T1548.002
    atomic_guid: 28104f8a-4ff1-4582-bcf6-699dce156608
license: DRL-1.1
related:
  - id: 724ea201-6514-4f38-9739-e5973c34f49a
    type: derived