Query: write Sigma for Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34). Logsource: windows / process_creation. Rule: title: UAC Bypass Using Disk Cleanup id: b697e69c-746f-4a86-9f59-7bfff8eab881 status: test description: Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: CommandLine|endswith: '"\system32\cleanmgr.exe /autoclean /d C:' ParentCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uninstallation or termination of security products using the WMIC utility. Logsource: windows / process_creation. Rule: title: Potential Tampering With Security Products Via WMIC id: 847d5ff3-8a31-4737-a970-aeae8fe21765 related: - id: b53317a0-8acf-4fd1-8de8-a5401e776b96 type: derived status: test description: Detects uninstallation or termination of security products using the WMIC utility references: - https://twitter.com/cglyer/status/1355171195654709249 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-01-30 modified: 2025-12-15 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_cli_1: CommandLine|contains|all: - wmic - 'product ' - uninstall CommandLine|contains|windash: /nointeractive selection_cli_2: CommandLine|contains|all: - wmic - 'caption like ' CommandLine|contains: - call delete - call terminate selection_cli_3: CommandLine|contains|all: - 'process ' - 'where ' - delete selection_product: CommandLine|contains: - '%carbon%' - '%cylance%' - '%endpoint%' - '%eset%' - '%malware%' - '%Sophos%' - '%symantec%' - Antivirus - 'AVG ' - Carbon Black - CarbonBlack - Cb Defense Sensor 64-bit - Crowdstrike Sensor - 'Cylance ' - Dell Threat Defense - DLP Endpoint - Endpoint Detection - Endpoint Protection - Endpoint Security - Endpoint Sensor - ESET File Security - LogRhythm System Monitor Service - Malwarebytes - McAfee Agent - Microsoft Security Client - Sophos Anti-Virus - Sophos AutoUpdate - Sophos Credential Store - Sophos Management Console - Sophos Management Database - Sophos Management Server - Sophos Remote Management System - Sophos Update Manager - Threat Protection - VirusScan - Webroot SecureAnywhere - Windows Defender condition: 1 of selection_cli_* and selection_product falsepositives: - Legitimate administration level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products/info.yml