Detection rules › Kusto

Detecting UAC bypass - ChangePK and SLUI registry tampering

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

This query identifies setting a registry key under HKCU, launching slui.exe and then ChangePK.exe.

MITRE ATT&CK coverage

TacticTechniques
Impact

Telemetry coverage

Rule body

id: 829a69ba-93e1-491f-8a1f-b19506e9d88a
name: Detecting UAC bypass - ChangePK and SLUI registry tampering
description: |
  This query identifies setting a registry key under HKCU, launching slui.exe and then ChangePK.exe.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1490
query: |
  DeviceProcessEvents
  | where InitiatingProcessParentFileName =~ "slui.exe"
  | where InitiatingProcessFileName =~ "changepk.exe"
  | where ProcessIntegrityLevel == "High"
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Account
    fieldMappings:
      - identifier: Sid
        columnName: AccountSid
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

DeviceProcessEvents

Stage 2: where

| where InitiatingProcessParentFileName =~ "slui.exe"

Stage 3: where

| where InitiatingProcessFileName =~ "changepk.exe"

Stage 4: where

| where ProcessIntegrityLevel == "High"

Indicators

These rows show field, operator, and value matches.