UAC Bypass Using WOW64 Logger DLL Hijack

Title: UAC Bypass Using WOW64 Logger DLL Hijack
Status: test
Description:Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
References:
  -https://github.com/hfiref0x/UACME
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
modified:2022-10-09
Tags:

• -'attack.privilege-escalation'
• -'attack.t1548.002'

Logsource:

• category: process_access
• product: windows

Detection:
  selection:
    SourceImage|contains: ':\Windows\SysWOW64\'
    GrantedAccess: '0x1fffff'
    CallTrace|startswith: 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'
  condition:selection
Falsepositives:
  -Unknown
Level: high