Windows UAC Bypass Attempt via IEInstal.exe Writing Consent.exe to Temp

title: Windows UAC Bypass Attempt via IEInstal.exe Writing Consent.exe to Temp
id: f5588e14-15de-425d-91ca-5adef7e12998
status: test
description: This rule flags file creation or related file events where IEInstal.exe is involved in writing a consent.exe into a user-scoped Temp location under AppData\Local\Temp. This behavior matters because UAC bypass techniques often stage privileged prompts or helper executables in per-user temporary directories. It relies on file event telemetry that records the process image path, the target filename path, and filename characteristics such as prefix, substring, and suffix matching.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_ieinstal.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image: C:\Program Files\Internet Explorer\IEInstal.exe
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains: \AppData\Local\Temp\
    TargetFilename|endswith: consent.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bdd8157d-8e85-4397-bb82-f06cc9c71dbb
    type: derived