Windows UAC bypass via changepk.exe launched from slui.exe with elevated integrity

title: Windows UAC bypass via changepk.exe launched from slui.exe with elevated integrity
id: 4b484a19-0234-4dd5-9bf7-d45ea0d8c5de
status: test
description: This rule matches process creation events where changepk.exe is started by slui.exe and the new process runs with elevated integrity levels (High or System). UAC bypass techniques often rely on trusted Windows binaries to obtain higher privileges without prompting the user. The detection relies on Windows process creation telemetry, including the parent process image path and the integrity level assigned to the spawned process.
references:
  - https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b
  - https://github.com/hfiref0x/UACME
  - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \changepk.exe
    ParentImage|endswith: \slui.exe
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 503d581c-7df0-4bbe-b9be-5840c0ecc1fc
    type: derived