Bypass UAC Using SilentCleanup Task

Title: Bypass UAC Using SilentCleanup Task
Status: test
Description:Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task
  -https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/
  -https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign
Author: frack113, Nextron Systems
Date: 2022-01-06
modified:2024-01-30
Tags:

• -'attack.privilege-escalation'
• -'attack.t1548.002'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\Environment\windir'
  filter_main_default:
    Details: '%SystemRoot%'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high