Windows UAC Bypass via ComputerDefaults.exe with Elevated Integrity Parent Process

title: Windows UAC Bypass via ComputerDefaults.exe with Elevated Integrity Parent Process
id: 13bef149-c61f-4589-8b79-22c87719dfdb
status: test
description: This rule identifies executions of C:\Windows\System32\ComputerDefaults.exe when the spawned process runs with high/system integrity levels and excludes cases where the parent process path contains common system and Program Files locations. Adversaries may use UAC bypass tooling to execute privileged actions while avoiding interactive prompts. The detection relies on process creation telemetry, including the target executable path, integrity level, and parent image path.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-31
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
    Image: C:\Windows\System32\ComputerDefaults.exe
  filter:
    ParentImage|contains:
      - :\Windows\System32
      - :\Program Files
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3c05e90d-7eba-4324-9972-5d7f711a60a8
    type: derived