{"id":"3268b746-88d8-4cd3-bffc-30077d02c787","title":"HackTool - Empire PowerShell UAC Bypass","description":"Detects some Empire PowerShell UAC bypass methods","author":"Ecco","status":"stable","level":"critical","date":"2019-08-30","modified":"2023-02-21","tags":["attack.privilege-escalation","attack.t1548.002","car.2019-04-001"],"technique_ids":["T1548.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml","source_sha256":"c1b0775e18f5db8e15314a4b5af978e03cb578403eb9e23b85252eee6a4794bd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Empire PowerShell UAC Bypass\nid: 3268b746-88d8-4cd3-bffc-30077d02c787\nstatus: stable\ndescription: Detects some Empire PowerShell UAC bypass methods\nreferences:\n    - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64\n    - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64\nauthor: Ecco\ndate: 2019-08-30\nmodified: 2023-02-21\ntags:\n    - attack.privilege-escalation\n    - attack.t1548.002\n    - car.2019-04-001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - ' -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update)'\n            - ' -NoP -NonI -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update);'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1548.002","id":"T1548.002","name":"Bypass User Account Control","page":"techniques/enterprise/T1548.002/"}],"data_path":"data/detection-rules/3268b746-88d8-4cd3-bffc-30077d02c787.json","kind":"sigma"}