Command interpreter spawned by an auto-elevated UAC bypass binary

Siemphony@siemphonyhighT1548.002verified in labPlaybook · Privilege escalation

Matches a process-creation event whose parent is one of the auto-elevated Windows binaries MITRE names in this analytic's ElevatedProcessNameList knob (eventvwr.exe, sdclt.exe, computerdefaults.exe and the closely related fodhelper.exe, slui.exe and wsreset.exe) and whose child is a command or script interpreter. That parent-child edge is the ParentProcessAnomalyThreshold knob written out as literals: these binaries elevate without a consent prompt, so an interpreter appearing beneath one is the observable moment of a hijacked auto-elevation. The analytic's real observable is a chain — registry write to a UAC-related key, then elevation, correlated inside a short TimeWindow — and Sigma cannot join two log sources or express a time window, so only the execution step is modelled here and the preceding registry tamper is not. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0388, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Command interpreter spawned by an auto-elevated UAC bypass binary2id: f1e07b28-4632-4407-8328-c6918008407d3status: experimental4description: |5  Matches a process-creation event whose parent is one of the auto-elevated6  Windows binaries MITRE names in this analytic's ElevatedProcessNameList knob7  (eventvwr.exe, sdclt.exe, computerdefaults.exe and the closely related8  fodhelper.exe, slui.exe and wsreset.exe) and whose child is a command or9  script interpreter. That parent-child edge is the ParentProcessAnomalyThreshold10  knob written out as literals: these binaries elevate without a consent prompt,11  so an interpreter appearing beneath one is the observable moment of a hijacked12  auto-elevation. The analytic's real observable is a chain — registry write to a13  UAC-related key, then elevation, correlated inside a short TimeWindow — and14  Sigma cannot join two log sources or express a time window, so only the15  execution step is modelled here and the preceding registry tamper is not.16  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0388, not hand-written and not tested by its author. Any lab result is on this rule's own page.17references:18  - https://attack.mitre.org/techniques/T1548/00219  - https://attack.mitre.org/detectionstrategies/DET038820author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)21date: 2026-08-1622tags:23  - attack.privilege-escalation24  - attack.t1548.00225logsource:26  category: process_creation27  product: windows28detection:29  selection_parent:30    ParentImage|endswith:31      - '\eventvwr.exe'32      - '\sdclt.exe'33      - '\computerdefaults.exe'34      - '\fodhelper.exe'35      - '\slui.exe'36      - '\wsreset.exe'37  selection_child:38    Image|endswith:39      - '\cmd.exe'40      - '\powershell.exe'41      - '\pwsh.exe'42      - '\wscript.exe'43      - '\cscript.exe'44      - '\mshta.exe'45      - '\rundll32.exe'46      - '\regsvr32.exe'47  condition: selection_parent and selection_child48falsepositives:49  - "Windows servicing and licensing repair, where wsreset.exe or slui.exe is driven by a vendor support script that wraps its own work in a cmd.exe one-liner. This is exactly what MITRE's ElevatedProcessNameList knob is for — a site that sees a given binary legitimately spawning an interpreter should remove it from the parent list rather than tune the child list."50  - "An administrator troubleshooting from inside Event Viewer or Backup and Restore who then opens a shell in the same session. The parent-child edge is identical to the bypass and only the operator and the surrounding activity distinguish them; MITRE's ParentProcessAnomalyThreshold knob is where that judgement belongs."51  - "Software packaging and OEM setup routines whose MSI custom actions chain through computerdefaults.exe or sdclt.exe and then call rundll32.exe or regsvr32.exe to register components during installation."52  - "Authorised red-team and UAC-hardening validation runs, which use precisely these binaries and will fire this rule on every execution."53level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\eventvwr.exe" or InitiatingProcessFolderPath endswith "\\sdclt.exe" or InitiatingProcessFolderPath endswith "\\computerdefaults.exe" or InitiatingProcessFolderPath endswith "\\fodhelper.exe" or InitiatingProcessFolderPath endswith "\\slui.exe" or InitiatingProcessFolderPath endswith "\\wsreset.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\eventvwr.exe" OR ParentImage="*\\sdclt.exe" OR ParentImage="*\\computerdefaults.exe" OR ParentImage="*\\fodhelper.exe" OR ParentImage="*\\slui.exe" OR ParentImage="*\\wsreset.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\eventvwr.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\sdclt.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\computerdefaults.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\fodhelper.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\slui.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wsreset.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\eventvwr\.exe$|\\sdclt\.exe$|\\computerdefaults\.exe$|\\fodhelper\.exe$|\\slui\.exe$|\\wsreset\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <description>Command interpreter spawned by an auto-elevated UAC bypass binary</description>    <mitre>      <id>T1548.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: privilege_escalation_abuse
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: f1e07b28-4632-4407-8328-c6918008407d

ATT&CKT1548.002

T1548.002Bypass User Account Control

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification4 runs

Verified in Siemphony lab

Security Datasets — UAC bypassed through the fodhelper auto-elevate path
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Security Datasets — UAC bypassed through CMSTP profile installation
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Security Datasets — UAC bypass (auto-elevate)
passed
Siemphony IR · 3 Sept 2026
4 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1548.002, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's `ElevatedProcessNameList` knob: if a given binary legitimately
Move rundll32.exe and regsvr32.exe into a separate, lower-confidence
The better rule is the one not written. A registry_set detection on writes
Knob that could not be implemented: `TimeWindow`, the 30-second correlation

Declared by the author

Windows servicing and licensing repair, where wsreset.exe or slui.exe is driven by a vendor support script that wraps its own work in a cmd.exe one-liner. This is exactly what MITRE's ElevatedProcessNameList knob is for — a site that sees a given binary legitimately spawning an interpreter should remove it from the parent list rather than tune the child list.
An administrator troubleshooting from inside Event Viewer or Backup and Restore who then opens a shell in the same session. The parent-child edge is identical to the bypass and only the operator and the surrounding activity distinguish them; MITRE's ParentProcessAnomalyThreshold knob is where that judgement belongs.
Software packaging and OEM setup routines whose MSI custom actions chain through computerdefaults.exe or sdclt.exe and then call rundll32.exe or regsvr32.exe to register components during installation.
Authorised red-team and UAC-hardening validation runs, which use precisely these binaries and will fire this rule on every execution.

Lessonprivilege escalation abuse

privilege escalation abuseAI draft — unreviewed

01 · What this rule detects

A process-creation event where the parent is a Windows binary that auto-elevates without a consent prompt, and the child is a command or script interpreter. That is the visible tail of a UAC bypass. The bypass itself is a registry write: the attacker points HKCU\Software\Classes\ms-settings\Shell\Open\command (or mscfile\shell\open\command) at a payload, sets DelegateExecute, then runs fodhelper.exe. Windows auto-elevates fodhelper, fodhelper honours the hijacked verb, and the payload starts at High integrity with no prompt. MITRE's AN1094 describes the whole chain: registry tamper, then elevation, correlated inside a TimeWindow. Sigma cannot join two log sources and has no timeframe, so only the execution step is modelled. The rule says so. What it does not say is that the execution step is the weaker half.

02 · Telemetry you need

category: process_creation, product: windows, verbatim from the brief. On
Two fields: ParentImage and Image. No command line, so this rule survives on
Offered by the brief and unused: registry_set (Sysmon 13) and

03 · How the logic works

Why the AND is the rule. selection_parent alone fires every time a user opens Event Viewer or Backup and Restore. selection_child alone is "an interpreter started", which is most of Windows. The parent-child edge is the observation; neither field carries it alone. Attribution, done correctly. rule.yml says the parents are the binaries "MITRE names in this analytic's ElevatedProcessNameList knob (eventvwr.exe, sdclt.exe, computerdefaults.exe and the closely related fodhelper.exe, slui.exe and wsreset.exe)". MITRE named three; the author added three. That phrasing is the difference between a sourced list and one that merely reads as sourced. MITRE's ParentProcessAnomalyThreshold knob is likewise a concept; the eight-item interpreter list is the author's rendering of it as literals. The child list is the weak point, and the reviewer is blunt about it. Trace the same bypass twice. Point the hijacked verb at cmd.exe /c payload — parent matches, child matches, rule fires. Now point it at C:\Users\x\AppData\Local\Temp\payload.exe, or at msiexec.exe, or at a copy of cmd.exe under another name — the parent still matches, the child matches nothing, the rule is silent while the bypass works identically. This is a detector for one payload shape, not for the bypass. It catches the demo form of the technique. Nothing in the match is evidence of elevation. The identical parent-child edge occurs at Medium integrity when the bypass fails, and on a host with UAC set to Never Notify. Sysmon 1 carries IntegrityLevel and 4688 carries TokenElevationType, but neither is safe to use on the shared process_creation taxonomy, so the omission is defensible — just do not read a hit as "escalation succeeded."

04 · Common false positives

**sdclt.exe and computerdefaults.exe spawning `rundll32.exe
An administrator troubleshooting from inside Event Viewer who then opens a
Vendor servicing and licensing repair wrapping its work in a cmd.exe
MSI custom actions chaining through computerdefaults.exe or sdclt.exe to
Authorised red-team and UAC-hardening validation, which uses exactly these

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0388 and never executed against a log line. level: high reflects that the parent-child edge is rare in aggregate, not a measured rate; the Wazuh render emits level 12 from it. To reach
tier_2: confirm process creation is audited, baseline how often your estate legitimately produces each of the six parents spawning each of the eight children, and split the rundll32 leg out on the evidence.
tier_3: means adding the registry rule and correlating the two — the elevation itself, and the tamper that caused it, in one alert.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/f1e07b28-4632-4407-8328-c6918008407d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Command interpreter spawned by an auto-elevated UAC bypass binary

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it