Windows UAC Bypass via Disk Cleanup cleanmgr.exe run from Scheduled Task

title: Windows UAC Bypass via Disk Cleanup cleanmgr.exe run from Scheduled Task
id: 89e32672-f8b3-44fa-b985-d556a7921617
status: test
description: This rule matches Windows process creation where cleanmgr.exe is launched with specific arguments for disk cleanup and is executed under elevated integrity. It also correlates the parent process to the Task Scheduler service host (svchost.exe running the Schedule service), which is consistent with UAC bypass techniques that rely on trusted system components. Detection relies on process creation telemetry, including command line content, parent command line, and integrity level values.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|endswith: '"\system32\cleanmgr.exe /autoclean /d C:'
    ParentCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b697e69c-746f-4a86-9f59-7bfff8eab881
    type: derived