Title:
Explorer NOUACCHECK Flag
Status:
test
Description:Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks
References:
-https://twitter.com/ORCA6665/status/1496478087244095491
Author: Florian Roth (Nextron Systems)
Date: 2022-02-23
modified:2022-04-21
Tags:
- -'attack.privilege-escalation'
- -'attack.t1548.002'
Logsource:
- category: process_creation
- product: windows
Detection:
selection:
Image|endswith:
'\explorer.exe'
CommandLine|contains:
'/NOUACCHECK'
filter_dc_logon:
ParentCommandLine:
'C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule'
ParentImage:
'C:\Windows\System32\svchost.exe'
condition:
selection and not 1 of filter_*
Falsepositives:
-Domain Controller User Logon
-Unknown how many legitimate software products use that method
Level:
high
