ComputerDefaults UAC Bypass (PowerShell)

id: '32258.57389'
title: ComputerDefaults UAC Bypass
description: 'computerdefaults.exe is a legitimate Windows executable handling the
  Default Programs feature in Windows. This feature allows users to set default programs
  for specific tasks such as web browsing, email, and media playback. Threat actors
  may modify the registry to have computerdefaults.exe run arbitrary commands when
  executed, potentially leading to UAC bypass. This use case detects modifications
  to the registry key HKCU\Software\Classes\ms-settings\shell\open\command which is
  associated with computerdefaults.exe. Atomics T1548.002 Test #5 Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("ADD" OR "Set-ItemProperty"
  OR "sp" OR "New-Item" OR "New-ItemProperty" OR "ni") "\\software\\classes\\ms-settings\\shell\\open\\command"
  "DelegateExecute" | table _time, host, user, process, process_*, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md