Windows Registry: Detect windir Environment Key Changes for SilentCleanup UAC Bypass
Detects non-default Environment\windir registry changes commonly used to facilitate SilentCleanup UAC bypass.
- Product
- windows
- Category
- registry_set
- Author
- frack113, Nextron Systems (SigmaHQ), DRL 1.1
- Published
- 2022-01-06
- Updated
- 2026-07-30
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry set activity where the Environment\windir key is written to a non-default value. Attackers may modify windir to influence an auto-elevated cleanup task (SilentCleanup) that resides under %windir%\System32\cleanmgr.exe, enabling privilege escalation without UAC prompting. The detection relies on registry set telemetry targeting the Environment\windir path and excludes writes that match the default %SystemRoot% value.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task
- reddit.comhttps://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/
- fortinet.comhttps://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Detect windir Environment Key Changes for SilentCleanup UAC Bypass"
id: 487b66b6-c01d-4e6b-ab85-8c4ed885834f
status: test
description: This rule flags registry set activity where the Environment\windir key is written to a non-default value. Attackers may modify windir to influence an auto-elevated cleanup task (SilentCleanup) that resides under %windir%\System32\cleanmgr.exe, enabling privilege escalation without UAC prompting. The detection relies on registry set telemetry targeting the Environment\windir path and excludes writes that match the default %SystemRoot% value.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task
- https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/
- https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml
author: frack113, Nextron Systems, Huntrule Team
date: 2022-01-06
modified: 2024-01-30
tags:
- attack.privilege-escalation
- attack.t1548.002
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Environment\windir
filter_main_default:
Details: "%SystemRoot%"
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/info.yml
simulation:
- type: atomic-red-team
name: Bypass UAC using SilentCleanup Task
technique: T1548.002
atomic_guid: 28104f8a-4ff1-4582-bcf6-699dce156608
license: DRL-1.1
related:
- id: 724ea201-6514-4f38-9739-e5973c34f49a
type: derived