attack.t1548.002 — sigma-tag tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Always Install Elevated MSI Spawned Cmd And Powershell · sigma-rule
• Always Install Elevated Windows Installer · sigma-rule
• Bypass UAC Using DelegateExecute · sigma-rule
• Bypass UAC Using SilentCleanup Task · sigma-rule
• Bypass UAC via CMSTP · sigma-rule
• Bypass UAC via Fodhelper.exe · sigma-rule
• Bypass UAC via WSReset.exe · sigma-rule
• CMSTP UAC Bypass via COM Object Access · sigma-rule
• Explorer NOUACCHECK Flag · sigma-rule
• Function Call From Undocumented COM Interface EditionUpgradeManager · sigma-rule
• HackTool - Empire PowerShell UAC Bypass · sigma-rule
• HackTool - UACMe Akagi Execution · sigma-rule
• HackTool - WinPwn Execution · sigma-rule
• HackTool - WinPwn Execution - ScriptBlock · sigma-rule
• Potential UAC Bypass Via Sdclt.EXE · sigma-rule
• Potentially Suspicious Event Viewer Child Process · sigma-rule
• PowerShell Web Access Feature Enabled Via DISM · sigma-rule
• Registry Modification of MS-settings Protocol Handler · sigma-rule
• Sdclt Child Processes · sigma-rule
• Shell Open Registry Keys Manipulation · sigma-rule
• Suspicious Shell Open Command Registry Modification · sigma-rule
• Trusted Path Bypass via Windows Directory Spoofing · sigma-rule
• TrustedPath UAC Bypass Pattern · sigma-rule
• UAC Bypass Abusing Winsat Path Parsing - File · sigma-rule
• UAC Bypass Abusing Winsat Path Parsing - Process · sigma-rule
• UAC Bypass Abusing Winsat Path Parsing - Registry · sigma-rule
• UAC Bypass Tools Using ComputerDefaults · sigma-rule
• UAC Bypass Using .NET Code Profiler on MMC · sigma-rule
• UAC Bypass Using ChangePK and SLUI · sigma-rule
• UAC Bypass Using Consent and Comctl32 - File · sigma-rule
• UAC Bypass Using Consent and Comctl32 - Process · sigma-rule
• UAC Bypass Using Disk Cleanup · sigma-rule
• UAC Bypass Using DismHost · sigma-rule
• UAC Bypass Using IDiagnostic Profile · sigma-rule
• UAC Bypass Using IDiagnostic Profile - File · sigma-rule
• UAC Bypass Using IEInstal - File · sigma-rule
• UAC Bypass Using IEInstal - Process · sigma-rule
• UAC Bypass Using Iscsicpl - ImageLoad · sigma-rule
• UAC Bypass Using MSConfig Token Modification - File · sigma-rule
• UAC Bypass Using MSConfig Token Modification - Process · sigma-rule
• UAC Bypass Using NTFS Reparse Point - File · sigma-rule
• UAC Bypass Using NTFS Reparse Point - Process · sigma-rule
• UAC Bypass Using PkgMgr and DISM · sigma-rule
• UAC Bypass Using Windows Media Player - File · sigma-rule
• UAC Bypass Using Windows Media Player - Process · sigma-rule
• UAC Bypass Using Windows Media Player - Registry · sigma-rule
• UAC Bypass Using WOW64 Logger DLL Hijack · sigma-rule
• UAC Bypass via Event Viewer · sigma-rule
• UAC Bypass via ICMLuaUtil · sigma-rule
• UAC Bypass via Sdclt · sigma-rule
• UAC Bypass Via Wsreset · sigma-rule
• UAC Bypass With Fake DLL · sigma-rule
• UAC Bypass WSReset · sigma-rule
• UAC Disabled · sigma-rule
• UAC Notification Disabled · sigma-rule
• UAC Secure Desktop Prompt Disabled · sigma-rule