UAC Bypass via Windows Firewall Snap-In Hijack

Title: UAC Bypass via Windows Firewall Snap-In Hijack
Status: test
Description:Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in
References:
  -https://www.elastic.co/guide/en/security/current/uac-bypass-via-windows-firewall-snap-in-hijack.html#uac-bypass-via-windows-firewall-snap-in-hijack
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.t1548'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\mmc.exe'
    ParentCommandLine|contains: 'WF.msc'
  filter:
    Image|endswith: '\WerFault.exe'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: medium