Sigma detection rules, expert-reviewed

Windows Atera RMM Agent Installation via MsiInstaller Event ID 1033

Flags Windows MSI installs where installer logs indicate an AteraAgent installation (EventID 1033, MsiInstaller).

Windows UAC Bypass via ComputerDefaults.exe with Elevated Integrity Parent Process

Flags ComputerDefaults.exe runs at high/system integrity when the parent isn’t from typical system or Program Files paths.

Windows Registry UAC Bypass via winsat.exe LowerCaseLongPath and UACMe Path Parsing

Matches registry writes that reference winsat.exe using a LowerCaseLongPath construction consistent with UAC bypass path parsing.

Windows Process Creation: UAC Bypass via winsat.exe Path Parsing

Alerts on elevated processes spawned by Temp-path winsat.exe with system32 winsat command-line content.

Windows UAC Bypass via NTFS Reparse Point: wusa.exe DLL Hijacking Process Behavior

Alerts on high-integrity wusa.exe launched from Temp update.msu with a dism.exe parent showing DismHost activity.

Windows UAC Bypass via msconfig Token Modification (msconfig.exe -5) Process Creation

Flags msconfig.exe invoked with -5 from a Temp pkgmgr.exe parent under elevated integrity levels, indicating a possible UAC bypass.

Windows UAC Bypass via IEInstal.exe Launching consent.exe from Temp with Elevated Integrity

Alerts on elevated consent.exe spawned by ieinstal.exe from Temp, indicating a possible Windows UAC bypass chain.

Windows UAC Bypass via DismHost.exe DLL Hijacking

Flags DismHost.exe executions from AppData\Local\Temp running as High/System integrity, consistent with UAC bypass via DLL hijacking.

Windows UAC Bypass via Disk Cleanup cleanmgr.exe run from Scheduled Task

Flags scheduled-task executions of cleanmgr.exe with disk-cleanup parameters running at high/System integrity.

Windows: Detect UACMe (Akagi.exe) execution via PE metadata and image name

Flags Windows processes likely running UACMe (Akagi.exe/Akagi64.exe) using PE metadata and known IMPHASH indicators.

Windows: Detect UAC bypass attempts via winsat.exe path parsing from user temp

Flags file activity targeting Temp\system32\winsat.exe (or winmm.dll) under C:\Users\ consistent with a UAC bypass attempt.

Windows UAC bypass using NTFS reparse point to place a hijack DLL in Temp

Alerts on file events pointing to a Temp legacy kernel32 DLL within user AppData, consistent with UAC bypass via reparse/DLL targeting.

Windows UAC Bypass via msconfig Token Modification Dropping pkgmgr.exe from Temp

Alerts on writes to C:\Users\…\AppData\Local\Temp\pkgmgr.exe indicative of msconfig-based UAC bypass staging.

Windows UAC bypass via IEInstal.exe dropping consent.exe to Temp

Alerts on IEInstal.exe activity writing consent.exe under AppData Local Temp to support a UAC bypass attempt.

Windows UAC Bypass via .NET Code Profiler DLL Hijacking on mmc.exe (pe386.dll in Temp)

Flags creation of Temp\pe386.dll under a user profile, consistent with mmc/.NET code profiler UAC bypass behavior.