Windows UAC bypass attempt via NTFS reparse point targeting Temp DLL path

title: Windows UAC bypass attempt via NTFS reparse point targeting Temp DLL path
id: 2a0047ff-a9cb-4110-9c93-9bb807af53fb
status: test
description: "This rule flags file events where a path under C:\\Users\\ is associated with a specific DLL name located in the AppData\\Local\\Temp directory: api-ms-win-core-kernel32-legacy-l1.DLL. Such targeting can be used during UAC bypass workflows that rely on NTFS reparse points and DLL manipulation to trigger elevated behavior. It relies on file event telemetry capturing the relevant TargetFilename patterns (prefix and suffix match)."
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Users\
    TargetFilename|endswith: \AppData\Local\Temp\api-ms-win-core-kernel32-legacy-l1.DLL
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7fff6773-2baa-46de-a24a-b6eec1aba2d1
    type: derived