Windows UAC Bypass Indicator via sdclt Registry Key Manipulation

title: Windows UAC Bypass Indicator via sdclt Registry Key Manipulation
id: 059d05ec-25ef-4cbe-8ca0-9e8cdd91b731
status: test
description: This rule flags registry modifications tied to UAC bypass behavior by matching specific TargetObject paths associated with sdclt.exe registry entries. Attackers use this technique to influence elevated execution flows without triggering the typical user consent prompt. The detection relies on Windows registry set telemetry capturing the modified TargetObject fields and, in one case, a Details value matching a path pattern.
references:
  - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml
author: Omer Yampel, Christian Burkard (Nextron Systems), Huntrule Team
date: 2017-03-17
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.t1548.002
  - car.2019-04-001
logsource:
  category: registry_set
  product: windows
detection:
  selection1:
    TargetObject|endswith: Software\Classes\exefile\shell\runas\command\isolatedCommand
  selection2:
    TargetObject|endswith: Software\Classes\Folder\shell\open\command\SymbolicLinkValue
    Details|re: -1[0-9]{3}\\Software\\Classes\\
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5b872a46-3b90-45c1-8419-f675db8053aa
    type: derived