Windows UAC Bypass via msconfig Token Modification (msconfig.exe -5) Process Creation

Flags msconfig.exe invoked with -5 from a Temp pkgmgr.exe parent under elevated integrity levels, indicating a possible UAC bypass.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Christian Burkard (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-08-30
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548.002Bypass User Account Control
Defense Evasion
- T1548.002Bypass User Account Control
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creations where msconfig.exe is launched with the "-5" argument and the spawning process appears to come from a Temp package manager binary path. It further constrains matches to processes running with high, system, or S-1-16 elevated integrity levels, consistent with attempts to elevate privileges via a UAC bypass technique. The detection relies on process creation telemetry including integrity level, parent process image path, and full command line.

Reporting behind it

Related detections9 linkedT1548.002 — drag to rearrange

Possible UAC Bypass via easinvoker Spawning Batch Script (via process_creation)

Suspicious UAC Bypass by Disabling Admin Consent Prompt via registry_set

Malicious Cloud Atlas UAC Bypass via fodhelper (via process_creation)

Suspicious computerdefaults.exe Spawning Child Process

Suspicious UAC Bypass via control.exe App Paths or Shell Open Command Hijack

Malicious UAC Bypass via COMAutoApprovalList Registry Modification (via registry_set)

Suspicious UAC Bypass via COMAutoApprovalList Registry Modification (via registry_set)

Malicious UAC Bypass via explorer.exe NOUACCHECK Argument

Suspicious UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

Windows UAC Bypass via msconfig Token Modification (msconfig.exe -5) Process Creation

Pivot detection · T1548.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-uac-bypass-via-msconfig-token-modification-msconfig-exe-5-process-creati-ad92e3f9

title: Windows UAC Bypass via msconfig Token Modification (msconfig.exe -5) Process Creation
id: 5da8a289-c3de-4732-b71f-4de65fb67e89
status: test
description: This rule identifies Windows process creations where msconfig.exe is launched with the "-5" argument and the spawning process appears to come from a Temp package manager binary path. It further constrains matches to processes running with high, system, or S-1-16 elevated integrity levels, consistent with attempts to elevate privileges via a UAC bypass technique. The detection relies on process creation telemetry including integrity level, parent process image path, and full command line.
references:
  - https://github.com/hfiref0x/UACME
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-30
modified: 2024-12-01
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    IntegrityLevel:
      - High
      - System
      - S-1-16-16384
      - S-1-16-12288
    ParentImage|endswith: \AppData\Local\Temp\pkgmgr.exe
    CommandLine: '"C:\Windows\system32\msconfig.exe" -5'
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ad92e3f9-7eb6-460e-96b1-582b0ccbb980
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL