huntrule

Windows UAC Bypass via consent.exe and comctl32.dll File Target Path

Detects suspicious target path patterns involving consent.exe.@ and comctl32.dll consistent with UAC bypass staging.

FreeUnreviewedSigmahighv1
title: Windows UAC Bypass via consent.exe and comctl32.dll File Target Path
id: 054d3ffb-2f00-4e4e-a202-4e0e69ba2cd6
status: test
description: This rule flags file system events where the target path starts with C:\Windows\System32\consent.exe.@ and ends with \comctl32.dll. This matches a common staging pattern for UAC bypass techniques that use Windows components, where an attacker relies on the target filename path to trigger elevated behavior. The detection relies on file event telemetry capturing a TargetFilename field suitable for prefix/suffix matching.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_uac_bypass_consent_comctl32.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Windows\System32\consent.exe.@
    TargetFilename|endswith: \comctl32.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 62ed5b55-f991-406a-85d9-e8e8fdf18789
    type: derived

What it detects

This rule flags file system events where the target path starts with C:\Windows\System32\consent.exe.@ and ends with \comctl32.dll. This matches a common staging pattern for UAC bypass techniques that use Windows components, where an attacker relies on the target filename path to trigger elevated behavior. The detection relies on file event telemetry capturing a TargetFilename field suitable for prefix/suffix matching.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.