Elastic Security Detection Rules

UAC Bypass via Windows Firewall Snap-In Hijack

Last updated 5 months ago on 2025-03-20
Created 5 years ago on 2020-10-14

About

Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
Tags
Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Privilege EscalationTactic: Defense EvasionData Source: Elastic EndgameData Source: Elastic DefendData Source: SysmonData Source: Microsoft Defender for EndpointData Source: SentinelOneLanguage: eql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Privilege Escalation (TA0004)(opens in a new tab or window)

↳ Abuse Elevation Control Mechanism (T1548)(opens in a new tab or window)

Defense Evasion (TA0005)(opens in a new tab or window)

↳ System Binary Proxy Execution (T1218)(opens in a new tab or window)

↳ Abuse Elevation Control Mechanism (T1548)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
winlogbeat-*logs-endpoint.events.process-*logs-windows.sysmon_operational-*endgame-*logs-m365_defender.event-*logs-sentinel_one_cloud_funnel.*
Related Integrations

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

m365_defender(opens in a new tab or window)

sentinel_one_cloud_funnel(opens in a new tab or window)

Query
process where host.os.type == "windows" and event.type == "start" and
 process.parent.name == "mmc.exe" and
 /* process.Ext.token.integrity_level_name == "high" can be added in future for tuning */
 /* args of the Windows Firewall SnapIn */
  process.parent.args == "WF.msc" and process.name != "WerFault.exe"

Install detection rules in Elastic Security

Detect UAC Bypass via Windows Firewall Snap-In Hijack in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).