Explorer NOUACCHECK Flag

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Known false positives

Domain Controller User Logon
Unknown how many legitimate software products use that method

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548.002` Abuse Elevation Control Mechanism: Bypass User Account Control

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Explorer NOUACCHECK Flag
id: 534f2ef7-e8a2-4433-816d-c91bccde289b
status: test
description: Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks
references:
    - https://twitter.com/ORCA6665/status/1496478087244095491
author: Florian Roth (Nextron Systems)
date: 2022-02-23
modified: 2022-04-21
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\explorer.exe'
        CommandLine|contains: '/NOUACCHECK'
    filter_dc_logon:
        - ParentCommandLine: 'C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule'
        - ParentImage: 'C:\Windows\System32\svchost.exe' # coarse filter needed for ID 4688 Events
    condition: selection and not 1 of filter_*
falsepositives:
    - Domain Controller User Logon
    - Unknown how many legitimate software products use that method
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_*

Stage 1: `selection`

selection:
    Image|endswith: '\explorer.exe'
    CommandLine|contains: '/NOUACCHECK'

Stage 2: `not filter_dc_logon`

filter_dc_logon:
    - ParentCommandLine: 'C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule'
    - ParentImage: 'C:\Windows\System32\svchost.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ParentCommandLine`	eq	`C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule`	`excludes:ParentCommandLine` `field:"ParentCommandLine" value:"C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule"`
`ParentImage`	eq	`C:\Windows\System32\svchost.exe`	`excludes:ParentImage` `field:"ParentImage" value:"C:\Windows\System32\svchost.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/NOUACCHECK`	`field:"CommandLine" kind:match value:"/NOUACCHECK"`
`Image`	ends_with	`\explorer.exe` corpus 13 (sigma 13)	`field:"Image" kind:ends_with value:"\explorer.exe"`